I am trying to create something safe, but not terrible. 

What I need is to find a user in my database and then edits fields in that user. 
The way I currently do this is with code like this:

```
exports.buyItem = function(req, res, next) {
var token = req.body.token;
var playerID = req.body.playerID;
User.findOne({ token: SHA256(token)+playerID },
///implementation ( do something for that user)

```

Explanation: 
When the user logs in, a randomly generated token is created.
The token is then sent back to the user.
And it is also hashed and stored in the database (concatenated with the playerID)

**Now each time my user makes a request to the database he sends the token + playerID to the server which then validates as in the code above. (It checks if the hashed token +playerID is in the database)** 

Now, my questions are: 

* Given that the server would have a lot of traffic, would calculating
the hash every time a user requests something be a problem?(Would the SHA256 calculations destroy the server?)
* Do you see any other problem with the implementation, and do you have a suggestion as to what I should do differently?

I would prefer not using cookies.