Store token hashed only, to help against accidental leaks