Goes without saying that the token secret is not stored in plaintext in the db.