Hash login tokens

Based on session-hooks, so that should be merged first.