make generate token a safe url