title: Token based session management
body: <p>I use a GO server (golang.org), which does have good support for encryption and third party package which provides basic cookie based session handling.  I am looking for guidelines on generating tokens, and good practice to store, invalidate etc. My application need custom user management. Can one use Oauth in an offline setting, or any better way?</p>