don't use bytearrayoutputstream for token generation