ensure randomness in token creation