Ensure generated token is safe for url.
Add support for auth.token.created event.