finished token management without lock protection