Upload URL inconsistency with documentation

I am doing a Preflight check before file upload and according to the documentation I should get back and upload_url and upload_token. The response that I am getting back is 

{
  "upload_url": "https://upload.app.box.com/api/2.0/files/content?upload_session_id=0D54[REDACTED]&protected_params=0%21Lp3F[REDACTED]",
  "upload_token": null
}

Why is the token null and what is the protected_params? It looks like it's base64/url encoded.

Is there an example cURL with the subsequent call? I can't seem to find any.