There's tokenization code leaking into the parser code (in particular, in parseLiteral()). We should clean this up so it's clearer what's happening with number literals, for example, where we'd expect any number (with underscores, periods, etc.) to come through as one token vs. several.