From the TikZ/PGF manual (emphasis added):


  Some of the path commands described in the following sections take optional arguments. For these
  commands, when you use this key inside these options, the path will be inserted after the path
  command is done.


The key here is the "some".  The append after command needs a command to be appended after.  Things that work are node, edge, to, and likewise.  Your \path has no commands and so there is no chance of the append after command being executed.  What you want here is the insert path key which sticks in the path at that point.  Once you change that, then you get some output but you also find a few other (small) errors: you didn't name the nodes here and there, the fill=red command is a little odd, and the draw needs to be in brackets to be interpreted as a style.

\documentclass{article}
%\url{http://tex.stackexchange.com/q/154155/86}
\usepackage{tikz}

\tikzset{dimen/.style={&lt;-&gt;,&gt;=latex,thin,
  every rectangle node/.style={fill=white,midway}
}}

\tikzset{measuring south/.style args={from #1 to #2 is #3}{
    insert path={
      [draw] (#1.south west) -- ++(0,-1.0) 
            coordinate (A1) -- ++(0,-10pt)
            (#2.south east) -- ++(0,-1.0) coordinate (A2) -- ++(0,-10pt)
            [dimen] (A1) -- (A2) node {#3}
        }
    }
}

\begin{document}
\begin{tikzpicture}
    \node(a)  [draw,rectangle,text=teal] at (0,0) (here) {here};
    \node(b)  [draw,rectangle,text=olive] at (3,0) (there) {there};
    \path[measuring south=from here to there is far];

  \node(x) [draw,rectangle,text=blue] at (0,-2) {Heaven};
  \node(y) [draw,rectangle,text=red] at (3,-2) {Hell};
  \draw (x.south west) -- ++(0,-1.0) 
            coordinate (A1) -- ++(0,-10pt)
            (y.south east) -- ++(0,-1.0) coordinate (A2) -- ++(0,-10pt)
            [dimen] (A1) -- (A2) node {sin};
\end{tikzpicture}
\end{document}




Correct use of arguments pattern in pgfkeys/append after command in tikz?
So, I've created an authentication system. Poured over it for any kind of security flaws and tested the crap out of it. I think it's fairly secure, but there is one "different" by-design aspect of it that's not usual of a web authentication system. 

Basically, I wanted to make it so that authentication could be done without keeping track of each user's session. This means less load on the database, and trivial to scale and cache. Here are the "secrets" kept by the server:


A private-key is kept in the source code of the application
A randomly generated salt is kept for each user


To make it sessionless, but making forging cookies not easy, this is the format of my cookies

expires=expiretimestamp
secret=hash(privatekey + otherinfo + username + hashedpassword + expires)
username=username


(with otherinfo being things like IP address, browser info, etc and with hashedpassword=hash(username + salt + password + privatekey) 

My understanding is that forging login cookies (not cracking the passwords) requires:


Source code access to the application, or a way to trick it to spit out the private key
Read-only access to the database to get the salt and hashedpassword


Whereas the traditional session method requires:


Write and read access to the database (to inject the session, or trick the web app into doing it for you)
Possibly source code access depending on how it works


Anyway, does this seem overly insecure to anyone? Are there any ways for me to improve on it and make it more secure(while keeping with the stateless/sessionless model)? Are there any existing authentication systems which use this stateless model? 

Also, the hashing method can be basically anything, ranging from SHA256 to Blowfish
