> we search our database for short_token and hash(long_token). Sounds like some salt should be used here. Search the DB for short_token, then use the discovere

> we search our database for short_token and hash(long_token). Sounds like some salt should be used here. Search the DB for short_token, then use the discovered salt to check the "password".