https://celery94.github.io/posts/difference-between-session-based-auth-and-jwt/