Generate the token if the session doesn't have it.