removing the mutable/global state issue by having token.create return token/validate method