If I understood docs correctly to create a special token you'd need to supply it in a special array (which users presumably have no access to).