creating random auth token correctly