And how attackers forge tokens and log in as someone else.