why do people return jwt token despite setting cookie - Theo's Typesafe Cult