In theory, we should check that there is only one slash per token, but
it is not really dangerous.
(cherry picked from commit c10f4954f2cdc12c6e593c8975be159415b53619)