The token is further hashed with the application secret key the same way any token would be.