Successful Response
Deliberately carries no token: whoever holds one can push to that device, so echoing it back would put it in client logs and proxies.