QR DATA Payload should be a combination of user /box/item/

[CheoR]

Title

Unique QR codes are made from a combination of user/move/box/items data

Narrative

    As a: user 
    I want: unique QR codes that only authorized/authenticaed user can decode
    so that: hat only authorized/authenticaed user can decode

Acceptance criteria

    Given: user scans QR code and is authorized/authenticated
    When: they crate new codes
    Then: api uses user/box/item info to create unique data payload that only they can uncode