The token should always be sent as the last parameter, or at least after the $1text parameter.
MediaWiki:Apihelp-edit-param-token
From meteoplug
The token should always be sent as the last parameter, or at least after the $1text parameter.