Hash token instead of signed token