Inspect secure ways of token generation

[soygul]

• Plain AES with a long private pass seems ok but weak against dictionary attacks
• https://github.com/dgrijalva/jwt-go (but regular hashing algorithms can be brute forced a lot quicker than AES, and jwt standard implementations have security issues occasionally as it has many more moving parts [header, body, signature, etc.] than a regular encrypt-then-mac approach)
• obvious research on token generation algos...
• client certs might be the safest option

[soygul]

Now using client certs for mobile clients but still need JWT like tokens for Browser/WebSocket clients.