Function token_open_in_place 

pub fn token_open_in_place<'t>(
    key: &TokenKey<'_>,
    token: &'t mut [u8],
) -> Result<&'t [u8], TokenOpenError>

MAC-verified (constant time) then decrypted in place; the plaintext is a sub-slice of token.