corrected the way the token was created, and added an migration for the new password length