this has been moved to `TokenController`, which is more appropriate