title: Api Token auth how to avoid man-in-the-middle
body: <p>Let's imagine that I don't use SSL and I send a token in a HTTP headers. The token contains the user ID and is encrypted.</p>
  
  <p>I can imagine that a man-in-the-middle attacker could capture the token and use it. If I use SSL it should be secure enough? But if I don't use SSL... </p>
  
  <p>Can I add something to the token like for example the user's IP so I can check that the request IP and the encrypted IP in the token are the same? </p>
  
  <p>Can the man-in-the-middle attacker fake the IP address of the victim? Can I use any other user related information when generating the token?</p>
  
  <p>Thanks!</p>