密码存储为什么要做单向哈希、为什么要加盐，为什么要用Token代替用户密码进行鉴权

摘抄自spring-security官方文档：Password Storage :: Spring Security

描述密码存储历史，介绍了密码存储为什么要做单向哈希、为什么要加盐，为什么要用Token代替用户密码进行鉴权。

Throughout the years, the standard mechanism for storing passwords has evolved. In the beginning, passwords were stored in plaintext. The passwords were assumed to be safe because the data store the passwords were saved in required credentials to access it. However, malicious users were able to find ways to get large “data dumps” of usernames and passwords by using attacks such as SQL Injection. As more and more user credentials became public, security experts realized that we needed to do more to protect users' passwords.

Developers were then encouraged to store passwords after running them through a one way hash, such as SHA-256. When a user tried to authenticate, the hashed passw