Folks should have a platform-independent interface for getting the most appropriate Token Cache. This will save customers from needing to understand that they are choosing between implementations of types noted in #1, #3, or #4. This likely just looks like a function named get_protected_token_cache or similar.