Token/cookie provider for session-less node.js apps