When Is a Digital Token a Security, and Why Does It Matter?