Lookup just the new-style hashed token first, to avoid sending the
unhashed token to the database in a query when we don't need to.