title: User management in Single Page App + REST backend
body: <p>What is the best way to do user management in a single page JS (<a href="http://lhorie.github.io/mithril" rel="nofollow">Mithril</a>) app? I want users to login to load preferences and take on a role so they gain certain permissions. I have a REST API backend written in Python (<a href="http://falcon.readthedocs.org/" rel="nofollow">Falcon web framework</a>).  Having read a bit  into it, it seems to boil down to sending credentials to the backend and get a token back. But the question is how that should be done. It seems that <a href="https://auth0.com/blog/2014/01/07/angularjs-authentication-with-cookies-vs-token/" rel="nofollow">tokens are a better method than cookies</a>, but that has effects on the exchange of secrets/tokens.  the 'xhr.withCredentials' method seems to be cookie based for instance. JWT (json web tokens) seems like a modern, interesting option, but it's hard to find a clear explanation how it could be used with a SPA.. And once the Mithril app has a token, where should I store it and how should I use it with subsequent requests?</p>