check if _hashLoginToken exists and if so look for user with hashToken instead of loginToken