generates token via injected TokenGenerator, asks Clock for now, sets expiry to now+7d, persists through SessionRepository->create and returns the resulting Session. all 31 tests pass.
