> that will only tell developers "this is unsafe, keep using JWT instead". That's a good point. Maybe a header in the readme/docs like "Stateless Sessions", f

> that will only tell developers "this is unsafe, keep using JWT instead". That's a good point. Maybe a header in the readme/docs like "Stateless Sessions", followed by "Using PAST/JWT/etc. for stateless sessions is a terrible idea, because kittens will die needlessly and painfully [ obviously using an actual summary of why ]. Don't just take my word for it, here are some resources explaining further..."