add security/improve code/fix issue with tokens