Move one time token generation to get re-generated on any
unauthenticated request.