title: Firebase FCM token as security token for Android
body: <p>I am developing an Android app and wondering if using FCM tokens also as authorization tokens (and drop the current custom tokens) would be a good practice.</p>
  
  <p>Example scenario:</p>
  
  <ol>
  <li>When application is started for the first time the user gets a new
  FCM token</li>
  <li>With the login data, the app also sends the token</li>
  <li>On successful login, the token is stored on the server (with an generated expiration date), and will be sent from now on with each
  request from the client</li>
  <li>The server uses the token for validation of the request and for sending push notifications </li>
  <li>When token expiration date is passed, the requests will fail and user will be redirected to login</li>
  </ol>
  
  <p>Everything good so far, but what about FCM token rotation? 
  Should I save the FCM token in shared preferences? 
  How about user being logged in on multiple devices?</p>
  
  <p>Any advice on the matter would be much appreciated.</p>