Do not use the reserved parameter name `$token`. It is used by the CSRF protection mechanism.