store user's secure token in Rails.cache, keyed by session_id