secret token generation and persistence