Until we need more information than just the TGT value, I vote we keep it clear text. Base64 encoding offers no security benefit and users are strongly encouraged to run over https anyway. Once each service gets its own access token we should have the TGT for that user and the service ID in the token - then we should store it in JSON and Base64 encode it.