Move token hash generation to the server