vars 'code' and 'tokenString' are protected now