https://celery94.github.io/posts/session-jwt-token-sso-oauth2-explained/