Oops, don't forget step two of looking up the old-style unhashed token
OR an already converted new-style hashed token.