The json web token seems to be a good way to protect server apis from unauthorised access, but a jwt re