Blacklist gets persisted on the server and loaded if a user token is present.