lildude/habari-2FA — pull request #1 by lildude (2014-02-18 16:29:27+00:00)
Title: Verify the token passed to us.

Ooops, I was blindly accepting the token contents and hoping it matched what we have in the DB. This doesn't make the cookie token completely hack proof, but a little verification should make things a little more secure, I hope.

Removed the username from the cookie too to make it a little harder to associated with a particular user.