When a token is not a security.