use unique tokens to prevent double-submission of payments in the web UI