I was erring on the side that anyone writing a custom token implementation could read the source.