[security] introduce token factory.