Use bytes for creating the token digest, otherwise we'll get into trouble