Stop using JWT for sessions, part 2: Why your solution doesn't work | Dark Hacker News