for app usual usage, does not necessarily vet against db.

will vet cookie / header, does not necessarily vet against db.

for passing around via email, page embeds, etc.

descripes how the userid is used.

Implements the built-in AppEngine signing method This method uses a private key unique to your AppEngine application and the key may rotate from time to time.