pub fn generate_token(hmac_key: &[u8]) -> (String, Vec<u8>)
Generate a session token and its HMAC. Returns (token_string, hmac_bytes).