In theory, we should check that there is only one slash per token, but
it is not really dangerous.
(cherry picked from commit c10f4954)