implementing suggested fixes includes hashing pw and returning token resource creation properly