Shouldn't the token be encrypted?