password token in user hash now