protect \$token and own it; the caller should not concern themselves with this