fix form encoding, right hash for token