[merb]

You CBS Combine a session cookie with a jwt Token That get sent over a Header

[Normal_gaussian]

Which gives you the worst of both worlds