[WIP][security] introduce token factory.