What do you do with the random tokens after you've generated them?

The author's proposed solution of "Encrypt then authenticate" seems pretty reasonable.