zedtokens are always based on the top-level resour...