add a Transport config option for the key used to encrypt tokens (#4066)

* add a Transport config option for the key used to encrypt tokens

* handshake: remove unused error return values

internal/handshake/token_generator_test.go

@@ -16,9 +16,9 @@ var _ = Describe("Token Generator", func() {
 	var tokenGen *TokenGenerator
 
 	BeforeEach(func() {
-		var err error
-		tokenGen, err = NewTokenGenerator(rand.Reader)
-		Expect(err).ToNot(HaveOccurred())
+		var key TokenProtectorKey
+		rand.Read(key[:])
+		tokenGen = NewTokenGenerator(key)
 	})
 
 	It("generates a token", func() {