I would love more insight or experiences on going stateless/ session free. Are you explicitly signing every request that requires authentication for security purposes?