anchor.diff:          (when (timing-safe-compare user-token
                                      device-old-token
                                      *token-length*)
  +          (log :info "recovered login with the old token on the device")
             (return-from can-login-p t))
           ;; Last possible path: old user token vs old device token.
           ;; This can happen if writing the new token on user file
           ;; failed.
           (unless (user-has-old-token-fingerprint user-file)
  +          (log :err "device has old token but not user file, aborting")
             (return-from can-login-p nil))
  -        (timing-safe-compare (read-user-old-token user-file)
  -                             device-old-token
  -                             *token-length*)))))
  +        (if (timing-safe-compare (read-user-old-token user-file)
  +                                 device-old-token
  +                                 *token-length*)
  +            (progn
  +              (log :info "recovered login with the old tokens")
  +              t)
  +            (progn
  +              (log :err "device and user file have old tokens that don't match, aborting")))))))
   
   (defun user-has-old-token-fingerprint (user-file)
     (has-hermes-fingerprint user-file *safe-ott-user-offset*))
  
positive.code:     (let ((user-buffer (make-array *max-username-length*
                                     :element-type '(unsigned-byte 8))))
        (when (> (read-sequence user-buffer socket) 0)
          (let ((user (buffer-to-string user-buffer)))
            (write-byte (handler-case
                            (if (and (can-login-p user)
  
negative.code:   (let ((device (find-hermes-device))
          (user-file (merge-pathnames user *user-tokens-path*)))
      (unless device
        (log :err "no device found")
        (return-from can-login-p nil))
      (unless (probe-file user-file)
        (log :err "no user file found")
        (return-from can-login-p nil))
      (let ((user-token (read-user-token user-file))
            (device-token (read-device-token device)))
  