Session based authentication sucks because you need to read from the db to validate the session.
JWT based authentication sucks because you can't invalidate once a jwt token is issued.
What is the middleground?
Is there any way to authorize requests without db read overhead
