don't mess with security token fields