Token Authentication

Normally token authentication is done via this flow:
login -> return token -> use token to make request -> return new token 

While this is the most secure It has flaws.  If you request multiple objects using the same token (example: on page load) one request will not be valid.  I have used a method in the past I like.  Pretty much its the same however you create another model called "tokens" and set them to expire 30 seconds after the first use.  This will allow double request to make it through.  

On the client side the flow looks like this.
login request -> json response with token -> store token in cookie and data -> make request append token -> rewrite token after.