pub fn hash_token(raw: &str) -> String
Lowercase hex sha256: the only form of a credential the server keeps.