The migration operation's body.
to travels again rather than being read out of the token: the token is opaque to the caller, and an operation that took the destination only from its own ledger would give a caller no way to say what it thought it was doing - so a mismatch would be undetectable instead of a 400.
