provide tokens on initial signup so that users cannot spoof as other users easily

[stanleyhon]

there is an issue where a person registers as a user before the real user does.

[ShannonGreen]

How would the token work?
e: oh would it just be stored on the client? (and in the db)

[stanleyhon]

yes, so on registration, client gets a token, token is sent on every query.

problem is if someone requests token as someone else.

[ShannonGreen]

Solution: force people to register when they sign the yellow form in first year :P