https://kickadda.com/posts/jwt/jwt-vs-session-based-authentication/