auth token should be encypted

[rjrodger]

this is more secure

[mirceaalexandru]

This should be done by seneca-user not by seneca-auth

[AdrieanKhisbe]

$ touch

[indr]

I stumpled upon this article by the express-stormpath project a few days earlier: https://stormpath.com/blog/the-problem-with-api-authentication-in-express
To me, but I'm not an expert in this field, the different aspects sound very reasonable. Especially the part about multiple access tokens and the key pair consisting of the user id and a random uuid.

But this issue indeed belongs to the seneca-user plugin I think.

Oh and I'm not related to express-stormpath in any way, just to say