IMO still nothing wrong with using JWT, if forcing the algo. https://twitter.com/coderbyheart/status/861541895612366848