[snomad]

I found this to be a great resource when groking your question recently

http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo...

Also this previous HN thread https://news.ycombinator.com/item?id=13865459