customer: generate and validate token on download