Enrollment

Tokens are hashed at rest, expire, and can be consumed once.