Use redis/memcache to avoid constant DB hits. Alternatively, if a time limited token is practical, use a self-signed expiring token. One reason to avoid sessi

Use redis/memcache to avoid constant DB hits. Alternatively, if a time limited token is practical, use a self-signed expiring token. One reason to avoid sessions is security aspect of it. Cookies are handled automatically by the browser which opens the API up to XSS