allow for non-device-locked tokens