Use TimestampSigner to validate user in order to prevent replay attacks
Document TF_VERIFICATION_WINDOW in README
Pass login validation through a secure cookie and not url params
Document TF_SECURE_COOKIE