create controller.token in install_controller and hide token