JWT Authentication Done Right in Node.js (Most Tutorials Get This Wrong)#refresh token rotation#RS256 JWT#httpOnly cookie JWTZyVOPMay 24, 2026