create token in controller