I was thinking it might be nice to be able to have an HMACed token with an expiry as an option - so e.g. my main http-serving thing could provide one of those to allow the frontend to read for a bit but kick the user off after half an hour or whatever if the token isn't refreshed.
I've no issue with offloading SSL to a different process though, I tend to prefer doing that anyway a lot of the time.