anchor.diff:    (let ((device (find-hermes-device))
           (user-file (merge-pathnames user *user-tokens-path*)))
       (unless device
  +      (log :err "no device found")
         (return-from can-login-p nil))
       (unless (probe-file user-file)
  +      (log :err "no user file found")
         (return-from can-login-p nil))
       (let ((user-token (read-user-token user-file))
             (device-token (read-device-token device)))
  
positive.code:          (user-file (merge-pathnames user *user-tokens-path*))
           ;; I could read it on the user file too, really.
           (old-token (read-device-token device)))
      (when (and device (probe-file user-file))
        (write-device-old-token device old-token)
        (write-device-token device new-token)
        (write-user-old-token user-file old-token)
        (write-user-token user-file new-token)
        (write-device-zeroes device)
        (write-user-zeroes user-file))))
  
  (defun write-device-token (device token)
    (write-token device token *fingerprint-length*))
  
negative.code:       (when (timing-safe-compare user-token
                                   device-token
                                   *token-length*)
          (log :info "normal login successful")
          (return-from can-login-p t))
        (unless (has-hermes-fingerprint device *safe-ott-device-offset*)
          (log :err "tokens don't match, aborting")
          (return-from can-login-p nil))
        (let ((device-old-token (read-device-old-token device)))
          ;; Another possible path: new user token vs old device token.
  