[detaro]

Why frame this as only an either-or? Seems like it's a cheap additional layer of security.

You also might have components you haven't written yourself that don't use tokens, e.g. databases.