i wonder if we should log who tokens have been created for and what app, just in case, y'know