use correct hash of token