Phantom tokens: JWTs & sessions combined