When does a token become a security ?