Slight quibble: the token is just authentication. The authorization is done by the pad. Granted, the current scheme grants the access authorization to any authenticated tag, but that could change if butt-thentication took off.