generates password token and timestamp