raw token handed to the client: 43 characters (32 random bytes, base64url)
column token_hash holds:        64 hex characters (SHA-256)
rows matching the raw token:    0
rows matching its SHA-256:      1