anchor.diff:           (user-file (merge-pathnames user *user-tokens-path*))
            ;; I could read it on the user file too, really.
            (old-token (read-device-token device)))
  -    (when (and device (probe-file user-file))
  -      (write-device-old-token device old-token)
  -      (write-device-token device new-token)
  -      (write-user-old-token user-file old-token)
  -      (write-user-token user-file new-token)
  -      (write-device-zeroes device)
  -      (write-user-zeroes user-file))))
  +    (unless device
  +      (log :err "no device found to write new token")
  +      (return-from regenerate-token nil))
  +    (unless (probe-file user-file)
  +      (log :err "no user file to write new token")
  +      (return-from regenerate-token nil))
  +    (write-device-old-token device old-token)
  +    (write-device-token device new-token)
  +    (write-user-old-token user-file old-token)
  +    (write-user-token user-file new-token)
  +    (write-device-zeroes device)
  +    (write-user-zeroes user-file))
  +  t)
   
   (defun write-device-token (device token)
     (write-token device token *fingerprint-length*))
  
positive.code:         (when (timing-safe-compare user-token
                                     device-old-token
                                     *token-length*)
            (return-from can-login-p t))
          ;; Last possible path: old user token vs old device token.
          ;; This can happen if writing the new token on user file
          ;; failed.
          (unless (user-has-old-token-fingerprint user-file)
            (return-from can-login-p nil))
          (timing-safe-compare (read-user-old-token user-file)
                               device-old-token
                               *token-length*)))))
  
  (defun user-has-old-token-fingerprint (user-file)
    (has-hermes-fingerprint user-file *safe-ott-user-offset*))
  
negative.code:       (when (timing-safe-compare user-token
                                   device-token
                                   *token-length*)
          (log :info "normal login successful")
          (return-from can-login-p t))
        (unless (has-hermes-fingerprint device *safe-ott-device-offset*)
          (log :err "tokens don't match, aborting")
          (return-from can-login-p nil))
        (let ((device-old-token (read-device-old-token device)))
          ;; Another possible path: new user token vs old device token.
  