Removed user-side token generation (now server-side).