hash token with sha512 against timing attacs #3398