Add some salt to the hash, add a TODO, and clean some stuff
Rise the ECC level of the QRcode
Add token invalidation (and a library to hash them before storing them)