[EGreg]

There is a lot more you can do.

For example you can sign session IDs or API tokens when you issue them. That way you can check them and refuse requests that present invalid tokens without doing any I/O.

[PetahNZ]

JWT does that.