So, like I said, I'm confused about this stuff myself. 

But it looks to me like Rails4 code [uses am ActiveSupport::KeyGenerator object](https://github.com/rails/rails/blob/de5ef153984f4fc3229a3346a8a4a1595303afc8/railties/lib/rails/application.rb#L154) that I don't think existed in Rails3.  

My code simply does `ActiveSupport::MessageEncryptor.new( token )`, which I think is what Rails3 did, but Rails4 does more complicated things, I think involving classes that didn't exist in Rails3. It's possible this is just an "api difference", not an "actual way encryption happens" difference, i simply don't know. 

Additionally, it looks like jcoyne found some useful api which only exists in Rails 4.1 (not even Rails4). 

I could write a bunch of conditionals to do the encryption differently depending on Rails 3/4/4.1 -- but i still am not confident I know how to do it 'properly' in each of those Rails versions. 

If this is looking simpler to you than it looks to me, and you understand the code that will be proper and secure and work in each Rails version (whether with conditionals for each version or api shared in all of them), then please do share it, and I'll just do it however you want me to, no problem! As it is,  what I've got represents the best I was able to figure out.