How does a software token work?