Identity.new.valid? should not crash. So validate presence where needed and
skip the other validations if the value is absent.

hash token with sha512 against timing attacs #3398

We create them. let's reflect that in the verb.

Only storing the date as that should suffice for normal expiry and is less useful for identifying users by timestamps

it may not have been required before the RackTest support class.