I want to create a random string (token) which can be used to identify a user whilst avoiding any potential conflicts with any other users\' tokens.
What I was thinking
It is very unlikely, but Math.random() could return 0.0. In that case, the solution of pimvdb would return "" (empty string). So, here is another solution, which returns in every case a random base36 with 10 chars length:
function generateToken() {
Math.floor(1000000000000000 + Math.random() * 9000000000000000)
.toString(36).substr(0, 10)
}