token secured by md5