If you have concerns that the page might steal the tokens, leaving out the signature if you're not trying to debug it prevents a valid token from touching the site.