title: Salt values for REST API
body: <p>I am creating an REST based web application which, after successful user credentials validation, generates auth token and authenticates subsequent requests using this auth token.<p>
  The contents(although not fixed yet) of token are 
  AES_encrypt{username:SHA_256(username,user_specific_salt):timestamp:expiry_period}.<p>
  To avoid db call, I am trying to generate salt value based on  username itself.
  Also, I am not sending salt value to client.<p>
  The problem is, I am a bit confused about the solution since the articles I have read so far suggest not to generate salt values on the fly but store at db level. Can someone help me figure out the optimal solution for the above scenario?</p>