Is it really safe to pass around the jwt in the querystring? Also can't jwts be pretty big? Potentially too big for a GET?