Why do you think storing JWT in secure cookie is only secure solution?