security: don't use a negative Opt_err token index