chore($server): token-related TODO #7
[skip ci]