lol.

Store a strongly hashed copy of the password, but use weak hash on password for login token. oops