make generate_token and same_origin a public(non-underscored) file level function