Certification controller complete.

1.	Use sha256 to let user cannot define data from cookie.
(But I cannot prevent user to make cookie to use this solution.)
2.	Use certification def to check cookie and data's relationship, then return token.
3.	Use "begin rescue" and "case when" to predict the using result.