session tokens generation, password hashing