basic token generation and validation