Use a 64-bit random space and clear the token cookie upon success.