auth JWT Sessions on Top of Google OAuth: Why Both Passport's Google OAuth20 strategy proves identity once at login; a signed JWT with a 7-day expiry does everything after that. Neither one replaces the other.
