Initial checkin. Generates token (without client verification) at /oauth/token