Oh indeed, that is apparently a bug in the release script for the apps we develop on our own. Thanks for raising that issue. The upstream and package versions for those apps like surfer should always be in sync.
Not sure you even need that, as I recall writing some JS for a list of redirects based on the incoming request which could send you anywhere else as part of the index.html on a Surfer App.
The main issue I think was URL cloaking so the address bar doesn't change, while the content of the page does.
do you happen do see any other error on the surfer server side app logs while trying the failing command? I wonder if something errors and the Invalid token message is just a side effect then.
@insuusvenerati if you use one of the automated DNS providers, you can keep your server completely private just like you have now as well. No change in setup needed, don't even have to open port 80/443 ...