Ask HN: Cookies vs. JWT vs. OAuth