Not sure how I feel about importing something from `../middleware` in a model. Also, not sure what the cryptographic requirements of access/refresh tokens are... I figure they're probably the same as CSRF tokens, and since `uid()` is being used for those, it ought to be good enough for this too...