use hashes for passwords and tokens
fix signup