Move can create token logic

It makes sense to have this in the actual authtoken settings. As well.
This is where it is used.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>