base64 encode token again
lockbox key from server hack