Phantom tokens: JWTs & sessions combined

Jwt should not be persisted