Please consider changing all instances of "token" in the srcset parsing algorithm with "descriptor".

The use of "token" in this context is slightly misleading in that it makes it sound like these are the only tokens in each srcset value or each image candidate string. But the srcset value is not really a string of simple tokens, nor is each image candidate string a string of simple tokens. Instead each image candidate string is either a URL + descriptor pair, or a URL on its own with no descriptors. And if you're going to call the subparts of the descriptors part "tokens" you could just as well call the URLs "tokens" too.

So I'd suggest getting rid of "token" altogether here, and instead just using the more specific and descriptive "descriptors"—to make it more to clear just exactly what things this part of the srcset parsing algorithm is processing.