Class Token
A token represents an arbitrary, opaque sequence of secret bytes (preferably from a secure random source) whose possession gives the holder the right to some resource(s) or action(s). For a token to be recognized it must be presented in its entirety, i.e. bitwise exact. This includes any (optional) text prefixes.
Only the party presenting the token should store the token secret itself; any parties that need to identify and/or verify the token should store derivations of the token instead (TokenFingerprint and TokenCheckHash, respectively).
A Token object is bound to a particular TokenDomain, but any given secret token string may be used to create many Token objects for any number of domains; it is opaque and not in and by itself tied to any specific domain.