Some thoughts on when it's ok to use JWT https://techblog.bozho.net/using-jwt-sessions/