I feel like this name misrepresents this function, or hints that it actually does two things.  What about renaming `set_new_token` or splitting the generation of the token up from setting the token to the user.