Communication betwen passport and auth script should be protected by token

[yurem]

Current passport authentication script don't validate if it trigger passport authentication or not Before redirecting to passport it should generate token and send it to passport. Passport should send it back with response to allow validate it.

Also passport sends user profile in JSON format. We should use JWT signed token for this.

We also can use nonce and return back it in JWT to to mitigate replay attacks.

[jgomer2001]

Assigning this myself since I'll be working on #38

[jgomer2001]

Still missing:

We also can use nonce and return back it in JWT to to mitigate replay attacks.
I'm moving this feature for 4.1