added password / token salt