Also, worth mentioning this article as an opinion:

http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo...

Edit: Title is Stop using JWT for sessions