The latest JS ilp-protocol-stream is no longer generating a random token, but is instead encrypting it based upon the server secret. We should consider doing the same.
See code here: https://github.com/interledgerjs/ilp-protocol-stream/blob/master/src/server.ts#L200
Also see note here describing the differences: https://github.com/interledgerjs/interledgerjs/blob/master/packages/pay/src/controllers/asset-details.ts#L73