JWT should not be your default for sessions (2021) | Hacker News Reader