Add md5 + salt on accessToken, instead of userID