set PW and token salts