Provide configuration for token hashing algorithm

[Aetherus]

Since basically access tokens are generated per request, I think maybe BCrypt is not the best choice for token hashing because it is intentionally designed to be slow. Maybe salted MD5 or SHA1 is good enough for this situation.

I'm not sure if it is a good idea but I think an AES encrypted token which contains all or some info about the current user is also feasible, because it can reduce database accesses.

[zachfeldman]

@Aetherus nobody else commented saying this was important in 1.5 years or so, so I'm going to close this now. But good day to you!