[nijave]

There is middle ground. Authn can be stateless and authz stateful. Usually it's impractical to shove all the authz nuance into a JWT anyway

Doesn't address logging out a single session, though