...

Each time the service sees a token, it checks to see if exists in the db and is not expired and matches the username

Server based security

blah

Open Questions

1. Should we require user authentication to invoke managed operations from the command line?
   1. These operations do not go through the client, so we would have to a) create special JMX hook into the server based authentication scheme or b) create a separate authentication scheme for managed operations.
2. How should we hash passwords?
   1. Do we need a master serverKey hash? How is this generated and where is it stored?
   2. Do we need salt per user?
   3. Which hash algorithm should we use?
3. Do we need to associate a fingerprint (ip address, etc) with each AccessToken?
   1. How would we get this info server side? Does the client need to pass it along when logging in?