Phantom tokens: JWTs and sessions combined | Dark Hacker News