[kngspook]

Of course, hashing _and_ expiration would be best.

I'm not really seeing any good reason _not_ to expire them...