Код-ревью: регистрация, вход и сброс пароля

const crypto = require('crypto');
const jwt = require('jsonwebtoken');
const SECRET = 'supersecret';

app.post('/register', async (req, res) => {
  const hash = crypto.createHash('md5').update(req.body.password).digest('hex');
  await db.users.insert({ ...req.body, password: hash });
  res.json({ ok: true });
});

app.post('/login', async (req, res) => {
  const user = await db.users.findOne({ email: req.body.email });
  if (!user) return res.status(404).json({ error: 'User not found' });
  const hash = crypto.createHash('md5').update(req.body.password).digest('hex');
  if (hash !== user.password) return res.status(401).json({ error: 'Wrong password' });
  res.json({ token: jwt.sign({ id: user.id, role: user.role }, SECRET) });
});

app.post('/reset', async (req, res) => {
  const token = Math.random().toString(36).slice(2);
  await db.resets.insert({ email: req.body.email, token });
  res.json({ sent: true });
});

app.get('/me', (req, res) => {
  const payload = jwt.decode(req.headers.authorization);
  res.json(payload);
});