Integrate JSON Web tokens

[pdonorio]

They will help us to remove any database on the Flask instance on the frontend side.

[pdonorio]

There are the functions to use:
https://pyjwt.readthedocs.io/en/latest/usage.html

[pdonorio]

We are not going to use Flask-JWT as it does what Flask-Login is already doing for us

[pdonorio]

We should check which info to add to the JWT to be sure that the token can be invalidated on user request (or admin operation)

[pdonorio]

A good tutorial to understand JWT content:
http://blog.apcelent.com/json-web-token-tutorial-example-python.html

[pdonorio]

This issue raised another question, now that we are learning more about authentication:

it feels like Flask Login and Security gives too much bloatware and take too much control.
Since JWT is very great at keeping data in a secure way that can be passed, we could use it to avoid some database query and make some mechanism to authenticate with our own code, giving us some power.

I will think about this in the weekend.

[pdonorio]

Have been testing JWT all week.

They're so awesome they made us dump three Flask plugins and write our own authentication module!

[pdonorio]

Note: JWT created at each login with valid credentials is always valid.

We should save tokens created inside a global Graphdb node.
It should also save informations like: IP, hostname, timestamp_latest_activity, and so on.

[mdantonio]

Also note that such information can also be used to create a list of authenticated sessions to allow the user to force the logout of remote sessions

[pdonorio]

@mdantonio
Probably we may close here and create a separated issue for this "authenticated sessions" table.

[pdonorio]

JWT specifications will go on with #23