Token fixes

Damn this should've stayed $_POST