encrypt the token into a readable string
enforce the presence of the token in the callback url