generate the valid token on page load