Add POST /tokens — Token creation

token instead of hmacId ?