diff --git a/src/Microsoft.AspNet.Identity.EntityFramework/IdentityDbContext.cs b/src/Microsoft.AspNet.Identity.EntityFramework/IdentityDbContext.cs
index 5cf7c5e279..1b10d0f892 100644
--- a/src/Microsoft.AspNet.Identity.EntityFramework/IdentityDbContext.cs
+++ b/src/Microsoft.AspNet.Identity.EntityFramework/IdentityDbContext.cs
@@ -27,7 +27,7 @@ namespace Microsoft.AspNet.Identity.EntityFramework
         protected override void OnModelCreating(ModelBuilder builder)
         {
             // TODO: Temporary change. 
-            // Can be reverted once https://github.com/aspnet/EntityFramework/issues/1960 is closed
+            // Can be reverted once https://github.com/aspnet/EntityFramework/issues/2175 is closed
             builder.ForSqlServer().UseIdentity();
 
             builder.Entity<TUser>(b =>
diff --git a/src/Microsoft.AspNet.Identity/Rfc6238AuthenticationService.cs b/src/Microsoft.AspNet.Identity/Rfc6238AuthenticationService.cs
index 927a79c16c..15004ee275 100644
--- a/src/Microsoft.AspNet.Identity/Rfc6238AuthenticationService.cs
+++ b/src/Microsoft.AspNet.Identity/Rfc6238AuthenticationService.cs
@@ -9,21 +9,6 @@ using System.Text;
 
 namespace Microsoft.AspNet.Identity
 {
-    internal sealed class SecurityToken
-    {
-        private readonly byte[] _data;
-
-        public SecurityToken(byte[] data)
-        {
-            _data = (byte[])data.Clone();
-        }
-
-        internal byte[] GetDataNoClone()
-        {
-            return _data;
-        }
-    }
-
     internal static class Rfc6238AuthenticationService
     {
         private static readonly DateTime _unixEpoch = new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc);
@@ -72,7 +57,7 @@ namespace Microsoft.AspNet.Identity
             return (ulong)(delta.Ticks / _timestep.Ticks);
         }
 
-        public static int GenerateCode(SecurityToken securityToken, string modifier = null)
+        public static int GenerateCode(byte[] securityToken, string modifier = null)
         {
             if (securityToken == null)
             {
@@ -81,13 +66,13 @@ namespace Microsoft.AspNet.Identity
 
             // Allow a variance of no greater than 90 seconds in either direction
             var currentTimeStep = GetCurrentTimeStepNumber();
-            using (var hashAlgorithm = new HMACSHA1(securityToken.GetDataNoClone()))
+            using (var hashAlgorithm = new HMACSHA1(securityToken))
             {
                 return ComputeTotp(hashAlgorithm, currentTimeStep, modifier);
             }
         }
 
-        public static bool ValidateCode(SecurityToken securityToken, int code, string modifier = null)
+        public static bool ValidateCode(byte[] securityToken, int code, string modifier = null)
         {
             if (securityToken == null)
             {
@@ -96,7 +81,7 @@ namespace Microsoft.AspNet.Identity
 
             // Allow a variance of no greater than 90 seconds in either direction
             var currentTimeStep = GetCurrentTimeStepNumber();
-            using (var hashAlgorithm = new HMACSHA1(securityToken.GetDataNoClone()))
+            using (var hashAlgorithm = new HMACSHA1(securityToken))
             {
                 for (var i = -2; i <= 2; i++)
                 {
diff --git a/src/Microsoft.AspNet.Identity/UserManager.cs b/src/Microsoft.AspNet.Identity/UserManager.cs
index f0350e034c..661f78a4d4 100644
--- a/src/Microsoft.AspNet.Identity/UserManager.cs
+++ b/src/Microsoft.AspNet.Identity/UserManager.cs
@@ -1505,9 +1505,9 @@ namespace Microsoft.AspNet.Identity
         }
 
         // Two factor APIS
-        internal async Task<SecurityToken> CreateSecurityTokenAsync(TUser user)
+        internal async Task<byte[]> CreateSecurityTokenAsync(TUser user)
         {
-            return new SecurityToken(Encoding.Unicode.GetBytes(await GetSecurityStampAsync(user)));
+            return Encoding.Unicode.GetBytes(await GetSecurityStampAsync(user));
         }
 
         /// <summary>