Here is what I was talking about, a peek behind the curtain, what it means to use :paramname

#!/usr/bin/perl --
use strict; use warnings;
sub ddd { use Data::Dumper; print Data::Dumper->new([@_])->Useqq(1)->D
+ump, "\n"; }
use Dancer2;
get '/login:username:password' => sub { rand };
get '/signon/:username/:password' => sub { rand };
#~ ddd( app() );
ddd( app()->routes->{get} );
__END__
$VAR1 = [
          bless( {
                   "options" => {},
                   "_params" => [
                                "username:password"
                              ],
                   "spec_route" => "/login:username:password",
                   "regexp" => "^\\/login(?#token)([^\\/]+)\$",
                   "method" => "get",
                   "_should_capture" => 1,
                   "code" => sub { "DUMMY" },
                   "prefix" => undef
                 }, 'Dancer2::Core::Route' ),
          bless( {
                   "options" => {},
                   "_params" => [
                                "username",
                                "password"
                              ],
                   "spec_route" => "/signon/:username/:password",
                   "regexp" => "^\\/signon\\/(?#token)([^\\/]+)\\/(?#t
+oken)([^\\/]+)\$",
                   "method" => "get",
                   "_should_capture" => 1,
                   "code" => sub { "DUMMY" },
                   "prefix" => undef
                 }, 'Dancer2::Core::Route' )
        ];
[download]

https://metacpan.org/pod/distribution/Dancer2/lib/Dancer2/Cookbook.pod#Authentication

https://metacpan.org/pod/distribution/Dancer2/lib/Dancer2/Cookbook.pod#Password-Hashing

https://metacpan.org/pod/Dancer2::Plugin::Passphrase#Usage

Re: SessionID on a windows server (secure cookies)