generating tokens server side