I know a good spec for signing json data to store it as a token here, too