Reduce the size of tokens about django-sesame HOT 2 CLOSED

If the HMAC that protects the token's integrity depends on the user's password, we must fetch the user from the database before we can validate the token. This leaks existence of user ids through a timing attack -- which might not be a very large concern if you're using this relatively insecure library, but I'm still uncomfortable with it.

I prefer to stick with the current design which includes two levels of hashing:

• a HMAC managed by Django, which depends on SECRET_KEY, and ensures it isn't possible to forge a token; if a forged token is submitted, it fails the HMAC check, and that's it; nothing is leaked
• a hash of the user's password, in order to invalidate tokens on password change.

from django-sesame.

I had forgotten about this ticket. I came up with the same idea 4 years later, made a different decision, and implemented it in #53.

from django-sesame.