Only do tests if secure vars are enabled.
Make constructors private. They don't need to be public and users shouldn't be creating instance of the models.
Corrected the ApplicationTokenCreator to reflect its actual usage,
Document the Token class.
Add constructors that reflect required fields to the creators.
Add constructors that reflect required fields to the creators.