Our Django Book is Launched
One of my big concerns is user / session security.<p>I have tried to follow and reason through discussions on stackoverflow and much of tpatchek's notes.  I would be interested in how "high level" the security chapter is from anyone who has shelled out already.<p>For example I assume I will<p>1. only use persona or openid (avoids storing passwords in my servers thus making a lot of things much much easier)<p>2. sessions - store absolutley nothing in a session cookie other than a nonce session id, and lookup everrything I need from cache on servers form that sessionId<p>3. That seems to be it really<p>I just do not know where to go to have this discussion sensibly - any hints?