Comment by cogman10

Throw a session ID in the JWT and do the same thing.

JWT has a freeform payload that can literally be anything you want. Nothing about it prevents you from using a pattern like this.