Node.js Security Best Practices: JWT blacklisting, rate limiting, schema validation