Move web module into its own package
Extract cookie module from web module
Extract tokenizer interface for encryption type
Use constants instead of inline strings