Thanks for pointing that out. That's a good technique and it addresses a large concern about jwt that this article raised for me. I suppose it's still a problem with invalidating individual sessions but that's a smaller problem.