Session tokens must always contain clientId, userId (if any) and the list of allowed permissions

[ferjm]

Right now we are generating two kind of session tokens:

• For the admin user, with a payload like:

{
  "id": "admin",
  "scope": "admin"
}

• For regular users, with a payload like:

{
  "id": {
    "opaqueId": "facebook_id",
    "provider": "facebook",
    "clientKey": "02e9c7"
  },
  "scope": "user"
}

Session tokens must always contain a client key, a list of allowed permissions, and may have or may not have a user associated. So we should end up with:

• Anonymous session tokens:

{ 
  "clientId": "1234567890987654321",
  "scopes": ["sensorthings"]
}

• User session tokens:

{
  "clientId": "1234567890987654321",
  "userId": {
    "opaqueId": "facebook_id",
    "idp": "facebook"
  },
  "scopes": ["sensorthings"]
}

The list of permissions is tbd in #53