Move WebAuthToken to its own file