implement server side token generation