Nintendo makes the unfortunate decision of sending the plaintext token to the client in a few requests.
Instead of storing a SHA-256 hash of the MD5 we expect from the Wii, we now store both the computed MD5 and plaintext generated token during registration.
The author of this commit apologizes.