diff --git a/flag_lists.module b/flag_lists.module
index 4038fde..0109481 100644
--- a/flag_lists.module
+++ b/flag_lists.module
@@ -1408,7 +1408,7 @@ function flag_lists_page($action = NULL, $flag_name = NULL, $entity_id = NULL) {
 
   // Shorten up the variables that affect the behavior of this page.
   $js = isset($_REQUEST['js']);
-  $token = $_REQUEST['token'];
+  $token = isset($_REQUEST['token']) ? $_REQUEST['token'] : '';
 
   // Specifically $_GET to avoid getting the $_COOKIE variable by the same key.
   $has_js = isset($_GET['has_js']);
@@ -1444,7 +1444,7 @@ function flag_lists_page($action = NULL, $flag_name = NULL, $entity_id = NULL) {
     else {
       drupal_set_message($error);
       drupal_access_denied();
-      return;
+      exit;
     }
   }