The token is now generated by the client, not by the server anymore

The client generates a token and passes it to the server in the URL. The server
shows it to the user, that can accept or deny access to that token.
We also use more "application" than "token" in the messages to the user, to
hide a bit more the fact that there is a token/password.