Only allow insecure token lookup if a flag is given
Move to SHA256