redirect to root_path if something falls over
and move token generation to before_create