section 8.2.3 - handling token creation during signup (cookie time :)