[wglb]

Opaque token stored in the database is the secure way to go. Don’t use JWT.