Dont let token/sync listen on port 80, it should all be https.