shopping_carts table, and unauthenticated users can create a cart. When creating a cart, I'll use a token which will be stored in the client. I want to be able to restrict access to carts based on the token, so only a user who knows it can select / update it.