I believe the scheme is still generating the token server-side, no?

"The server validates the login information and creates an authentication token for the user"