@_helpers.positional(<NUM_LIT:2>)<EOL>def generate_token(key, user_id, action_id='<STR_LIT>', when=None):
digester = hmac.new(_helpers._to_bytes(key, encoding='<STR_LIT:utf-8>'))<EOL>digester.update(_helpers._to_bytes(str(user_id), encoding='<STR_LIT:utf-8>'))<EOL>digester.update(DELIMITER)<EOL>digester.update(_helpers._to_bytes(action_id, encoding='<STR_LIT:utf-8>'))<EOL>digester.update(DELIMITER)<EOL>when = _helpers._to_bytes(str(when or int(time.time())), encoding='<STR_LIT:utf-8>')<EOL>digester.update(when)<EOL>digest = digester.digest()<EOL>token = base64.urlsafe_b64encode(digest + DELIMITER + when)<EOL>return token<EOL>
Generates a URL-safe token for the given user, action, time tuple.

    Args:
        key: secret key to use.
        user_id: the user ID of the authenticated user.
        action_id: a string identifier of the action they requested
                   authorization for.
        when: the time in seconds since the epoch at which the user was
              authorized for this action. If not set the current time is used.

    Returns:
        A string XSRF protection token.