AuthToken is insecure.

[cagerton]

I was just glancing through your code and I noticed that your Gateway AuthToken class uses a uuid3 (configured with a DNS namespace) of a timestamp. It doesn't look like it's used anywhere, but I have to warn you that this will not produce a cryptographically secure value.

I'd like to encourage you to use an HMAC based token signature using a configurable application secret. This is how Django does it (link to Signer) and Tornado (link to create_signed_value) do it.

[cmdelatorre]

cagerton, thank you very much for pointing it. We will address this issue as soon as possible. Furthermore, a pull-request is welcome ;-)

Seriously, thanks for contributing.