Before you start to roll your own authentication system, you should take a look at some of the third-party systems available that handle the hard work for you. Check out these slides for a brief overview of Auth0, and why it might be a good choice for your product.
