pub fn generate_random_token() -> String
256 bits of CSPRNG entropy (two UUIDv4s), base64url-encoded.