Create new private token for uploads

We want to make sure each upload has it’s own unique token, because
even though the chance is slim, we don’t expire on the user