>> And pyca/cryptography instead of something terrible like pycryptodome!
pycrypto is terrible. The pycryptodome fork fixes most problems in it.
Also, maybe worth sharing you are listed as fourth contributor [1] to the cryptography library, and your web book is prominent on the project homepage, so this piece of opinion may be biased.
>> Concrete suggestion: use Fernet
Please don't. Don't use boutique protocols with informal specs and without test vectors generated by a sufficient number of independent implementations. Stick to RFC-backed protocols. Use JWT with rigid parameters. Even other cryptography author states that just supporting JWT and not Fernet would have been better [2].
[1] https://github.com/pyca/cryptography/blob/master/AUTHORS.rst