first token service implementation

Can we move this logic into a service object? So that the middlewares are only handling the web stuff?