tokens are now saved as sha256 hashes