always return a server_token