Stop using JSON Web Tokens. Use Cookies & Server Sessions instead