[security] add generic token factory.