JWT sessions in practice: what the tutorials skip

Issuing a token is the easy part. Revoking one, refreshing one and storing one are where the decisions are.