Where Should You Store SPA Tokens? A BFF + Session Authentication Design

# Overview