refactor: add fingerprint to JWT

[ravenclaw900]

Following best practices from https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.md#token-sidejacking.
Also doesn't send the token with every message, instead storing it in the memory of the backend and only sending it with a dedicated message.

[ravenclaw900]

I'm probably going to have to revert the fingerprint part of this since it can cause problems with multiple nodes and sending/setting cookies cross-domain.

[ravenclaw900]

The only way I can think of to get around it would be to only use the token generated by the node with the frontend, and use asymmetric signatures (pub/priv key) to verify the token. It still involves sending the cookie to another domain, but that actually seems like it can be done. The only big problem is getting the public key from the frontend node to the backend node(s), and it also wouldn't allow raw websocket access to only the backend node.

[ravenclaw900]

Hmm, after doing some research (reading random Reddit comments and looking up interesting things that they talked about), a Diffie–Hellman key exchange might let all of the nodes connect and get one shared secret to verify the token.