Phantom tokens: JWTs and sessions combined | Hacker News Reader