The SEC has finally weighed in on the crypto-token frenzy, and nobody’s going to jail—yet