I wouldn't make this a use class methods. It seems most of the methods here revolve around the session object, and thus it would make sense to make AuthenticityToken be initialized with a readable attribute session as follows:

```ruby
token = AuthenticityToken.new(session)
token.generate_masked
```

On the same topic, based on the Single Responsibility Principle, perhaps you could make different classes for the token generator and the token itself:

```ruby
token_builder = AuthenticityTokenGenerator.new(session)
token = token_builder.generate_masked
```

Of course, for consumers who only need the token object iself, the above can be simplified to:

```ruby
token = AuthenticityTokenGenerator.new(session).generate_masked  # => an AuthenticityToken object
```

Or an even simpler, with a class builder method:

```ruby
token = AuthenticityTokenGenerator.generate(session) # => an AuthenticityToken object
```
This way, the methods related to generating the token can be on the builder class, while the methods related to validating it can be on the token class itself.