JWT should not be your default for sessions | Hacker News