[gizzlon]

> With JWT, a browser does not send it with the request

Sure it does, just put the JWT in the cookie ;)