so if JWTs are supposed to be avoided, what's a better alternative? cookies? (does that not open another can of worms?)