Limitations of Security Tokens