code: func (f *aclFilter) redactPreparedQueryTokens(query **structs.PreparedQuery) {
  	// Management tokens can see everything with no filtering.
  	if f.authorizer.ACLWrite() {
  		return
  	}
  
  	// Let the user see if there's a blank token, otherwise we need
  	// to redact it, since we know they don't have a management
  	// token.
  	if (*query).Token != "" {
  		// Redact the token, using a copy of the query structure
  		// since we could be pointed at a live instance from the
  		// state store so it's not safe to modify it. Note that
  		// this clone will still point to things like underlying
  		// arrays in the original, but for modifying just the
  		// token it will be safe to use.
  		clone := *(*query)
  		clone.Token = redactedToken
  		*query = &clone
  	}
  }
docs: // redactPreparedQueryTokens will redact any tokens unless the client has a
  // management token. This eases the transition to delegated authority over
  // prepared queries, since it was easy to capture management tokens in Consul
  // 0.6.3 and earlier, and we don't want to willy-nilly show those. This does
  // have the limitation of preventing delegated non-management users from seeing
  // captured tokens, but they can at least see whether or not a token is set.