code: function (uid, token_source, onDone) {
  	
  	// generate a valid token to be returned
  	var token = UTIL.createToken();
  	
  	// store token back to DB
  	var onUpdated = function (error) {
  		if (error) {
  			var err = new Error(error.toString());
  			err.name = "l_createToken Error";
  			UTIL.safeCall(onDone, err);
  		}
  		else {
  			LOG.warn('pass_token [' + token + '] stored');
  			UTIL.safeCall(onDone, null, token);			
  		}
  	};
  	l_updateUser({uid: uid}, 'pass_tokens.' + token, token_source, onUpdated);
  }
docs: add/revoke a pass token returns the token or undefined if token store fail