PHP now handles token generation.

Code still uses premade session, but will generate a token per client now.