include the password in the token cache key generation