first token service implementation

I don't think UUIDs are secure/random enough for authentication tokens. @teemow ?