The problem seems to have to do with the stat cache patch. If you flush the directory containing the symlink from your cache, it works even without tokens. However, if you ls -l the link with tokens you can no longer look at it without tokens.