Using public keys to encode data inside the auth token itself is a brilliant way to keep the proxy stateless.