There currently isn't an endpoint for registering a client, so all clients will have been inserted manually.

I don't know enough about Hawk to know what you mean. Right now (locally as I've applied your guys' comments), I store `token = sha256(token)` in the DB.