JWT: Where to store JWT in the browser frontend?