Persistent login and JWT protection of api routes