Is hashing "hidden" data secure?

[munro]

I'm creating tokens with the password as part of the hash, but not part of the public signed data. The purpose being when they change their password, it invalidates their login token. So when they bring their token back, I rehash it with their password and then compare.

Is hashing private data in this way a secure thing to do? I haven't read about it, so I'm not sure if it's a safe thing to do.

signobj({username: 'ryan'}, 'SECRET KEY', {password: 'foobar'})
/**
 * [
 *    {username: 'ryan'},
 *    'SALT',
 *    'HASH' // with password
 * ];
 */

node-signobj/index.js

Line 39 in 1bd1af2

.update(JSON.stringify(pub.concat([hidden])))