Constant AUTHORIZATION_TOKEN 

const AUTHORIZATION_TOKEN: u64 = 0x03;

The one Parameter Type draft-16 lets a message carry more than once.

Section 9.2.2.1: “The AUTHORIZATION TOKEN parameter MAY be repeated within a message as long as the combination of Token Type and Token Value are unique after resolving any aliases.” That is the “unless the parameter definition explicitly allows multiple instances” carve-out of Section 9.2, and on draft-16 it is the only one. The same number is the AUTHORIZATION TOKEN Setup Parameter in Section 9.3.1.5, which describes itself as “funcionally equivalient to the AUTHORIZATION TOKEN message parameter” and lets an endpoint “specify one or more tokens”, so the exemption holds in both namespaces.

Uniqueness “after resolving any aliases” needs a session’s token cache, which a codec does not have. So repeats of this type are carried in both directions and the caller decides.