Our Django Book is Launched
One of my big concerns is user / session security.I have tried to follow and reason through discussions on stackoverflow and much of tpatchek's notes.  I would be interested in how "high level" the security chapter is from anyone who has shelled out already.For example I assume I will1. only use persona or openid (avoids storing passwords in my servers thus making a lot of things much much easier)2. sessions - store absolutley nothing in a session cookie other than a nonce session id, and lookup everrything I need from cache on servers form that sessionId3. That seems to be it reallyI just do not know where to go to have this discussion sensibly - any hints?