Make headerGenerator use the token secret when computing the signature

I admit to being a bit confused here, because I don't see how `headerGenerator` can actually work except perhaps in some odd setup where the token and token secret are one and the same.

Certainly it won't in general without taking a separate token_secret and using that when computing the signature.