moved token generation into bootstrap