I'm not too familiar with ruby/rails, but does this mean the HTTP request just sits open for up to 20 seconds? Is this common/acceptable practice?
# user is given 20 seconds to approve the request
20.times{
sleep 1
sltoken = REDIS.get("sl:#{state}")
break if sltoken
}