Comment by tus88

> In my experience, don't use JWT's for carrying application state.

Wasn't the question about using them for auth, not application state?