}
public static String issueRandomAPIToken() {
// we need to see our tokens with a random value so the same one isn't generated
// for the same user each time.
RandomNumberGenerator rng = new SecureRandomNumberGenerator();
Object randomNumber = rng.nextBytes();
// we also use a user agent as a validation factor
// so when we later validate the token, we also validate the user agent
String secret = generateRandomString();
String salt = secret.concat(randomNumber.toString());