title: Is devise's token_authenticatable secure?
body: <p>I'm building a simple api with <a href="https://github.com/rails-api/rails-api">Rails API</a>, and want to make sure I'm on the right track here. I'm using devise to handle logins, and decided to go with Devise's <code>token_authenticatable</code> option, which generates an API key that you need to send with each request.</p>
  
  <p>I'm pairing the API with a backbone/marionette front end and am generally wondering how I should handle sessions. My first thought was to just store the api key in local storage or a cookie, and retrieve it on page load, but something about storing the api key that way bothered me from a security standpoint. Wouldn't be be easy to grab the api key either by looking in local storage/the cookie or sniffing any request that goes through, and use it to impersonate that user indefinitely? I currently am resetting the api key each login, but even that seems frequent - any time you log in on any device, that means you'd be logged out on every other one, which is kind of a pain. If I could drop this reset I feel like it would improve from a usability standpoint.</p>
  
  <p>I may be totally wrong here (and hope I am), can anyone explain whether authenticating this way is reliably secure, and if not what a good alternative would be? Overall, I'm looking for a way I can securely keep users 'signed in' to API access without frequently forcing re-auth.</p>