Keep hashed user tokens, with the following changes: