JSON Web Tokens should be avoided | Hacker News