will also implement deleteSession, refreshSession (refreshSession should revoke the old session token, right?)

New plan:

• give session tokens the same JTI as their corresponding refresh tokens.
• deleteSession will cover both the session and refresh tokens (because they share the same jti)
• refreshSession revokes the old session+refresh tokens and issues new ones.

general question: what's the point of having session tokens and refresh tokens being separate things?

Actually, refreshsession should probably not revoke access tokens (just the old refresh token). access tokens don't really need jti at all.

Edit: having jti in access tokens is useful for implementing deleteSession