Authorisation

For authorisation we use standard json web token approach, it's rotated with master key and distributed on every login.

Standard expiration time is 30 minutes, new token must be reissued after time expires.

JWT is stored in a secured https cookie on the client, therefore the client has no way to extract it's content.