Knowing when a token is invalid

[phrfpeixoto]

This lib is very nice and provides good functionality with little code. Thank you for you work @wichert.

On my project I find myself wanting to programatically react to invalid tokens, and I cant (at least not elegantly) because the policy simply logs the error.

I believe the sound behaviour would be to emit a warning, since you already do that on the remember and forget calls.

I've filed PR #25 to implement that. Please consider it.

[wichert]

What kind of action do you want to take in response to an invalid token?

[phrfpeixoto]

Knowing why a token is invalid is a good start. If that in had we can implement things like refresh tokens and/or take other security measures like blocking an account and so on.