don't store cookie token in database, only hash of it