fixed up create token (again) - now does not use promises but seems to return properly without headers after they have gone