fix returning the new token handle in DuplicateTokenEx