Use crypto-safe tokens for RequestTokens, too