Hash auth token

We should hash the auth token for increased security. (don't store it in cleartext in the db)

note: this requires making an migration script for the old to new format