cursor should reject a malformed token