The new four-factor test moves dozens of existing tokens out of regulatory limbo, and puts others squarely in the security bucket.