The hashing for the authentication is intentionally computationally slow (thus mitigating brute force validation). The token issued is basically like a session

The hashing for the authentication is intentionally computationally slow (thus mitigating brute force validation). The token issued is basically like a session id - validating a session id is really just like string compare, so it's much much fast.