All token passing is done via headers.
Creating random digest at logout.