With this method isn't the downside that you have to invalidate all tokens, and not just the attacker's tokens?
I believe people are downvoting you because you may have overlooked the processing that must happen on the server to encode the token in the first place.