docs: def create_token(secret, data, options=None):
      """
      Generates a secure authentication token.
   
      Our token format follows the JSON Web Token (JWT) standard:
      header.claims.signature
    
      Where:
      1) "header" is a stringified, base64-encoded JSON object containing version and algorithm information.
      2) "claims" is a stringified, base64-encoded JSON object containing a set of claims:
        Library-generated claims:
        "iat" -> The issued at time in seconds since the epoch as a number
        "d" -> The arbitrary JSON object supplied by the user.
        User-supplied claims (these are all optional):
        "exp" (optional) -> The expiration time of this token, as a number of seconds since the epoch.
        "nbf" (optional) -> The "not before" time before which the token should be rejected (seconds since the epoch)
        "admin" (optional) -> If set to true, this client will bypass all security rules (use this to authenticate servers)
        "debug" (optional) -> "set to true to make this client receive debug information about security rule execution.
        "simulate" (optional, internal-only for now) -> Set to true to neuter all API operations (listens / puts
                   will run security rules but not actually write or return data).
      3) A signature that proves the validity of this token (see: http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-07)
    
      For base64-encoding we use URL-safe base64 encoding. This ensures that the entire token is URL-safe
      and could, for instance, be placed as a query argument without any encoding (and this is what the JWT spec requires).
    
      Args:
          secret - the Firebase Application secret
          data - a json serializable object of data to be included in the token
          options - An optional dictionary of additional claims for the token. Possible keys include:
              a) "expires" -- A datetime or timestamp (as a number of seconds since the epoch) denoting a time after
                              which this token should no longer be valid.
              b) "notBefore" -- A datetime or timestamp (as a number of seconds since the epoch) denoting a time before
                              which this token should be rejected by the server.
              c) "admin" -- Set to true to bypass all security rules (use this for your trusted servers).
              d) "debug" -- Set to true to enable debug mode (so you can see the results of Rules API operations)
              e) "simulate" -- (internal-only for now) Set to true to neuter all API operations (listens / puts
                              will run security rules but not actually write or return data)
      Returns:
          A signed Firebase Authentication Token
      Raises:
          ValueError: if an invalid key is specified in options
  
      """
      if not isinstance(secret, basestring):
          raise ValueError("firebase_token_generator.create_token: secret must be a string.")
      if not options and not data:
          raise ValueError("firebase_token_generator.create_token: data is empty and no options are set.  This token will have no effect on Firebase.");
      if not options:
          options = {}
      is_admin_token = ('admin' in options and options['admin'] == True)
      _validate_data(data, is_admin_token)
      claims = _create_options_claims(options)
      claims['v'] = TOKEN_VERSION
      claims['iat'] = int(time.time())
      claims['d'] = data
  
      token = _encode_token(secret, claims)
      if len(token) > 1024:
          raise RuntimeError("firebase_token_generator.create_token: generated token is too long.")
      return token