generate the token and expiration before create