storing hashes of access_tokens instead of plain text tokens