[sscarduzio]

what I would have naturally done without anticipating any flaw (and probably be just OK):

   cache_key = sha(sha(id + username) + bcrypt(pass))

with sha256 or something.

[throwaway-9111]

Why not a simple sha(id + username + bcrypt(pass))

Is there any security issues with that? I'm a "newb" in this area, so I'm genuinely curious about the flaws with the naive approach