maintain access token hashes instead of the tokens themselves