CheckPasswordHash verifies a plain text password against a hashed password.

CreateToken creates a Base64-encoded token with shuffled characters.

DecodeToken decodes a double-encoded Base64 token, extracts userID, and validates it.