Security + JWT auth: gotchas and a clean solution

While implementing **JWT auth** in Security, I ran into tricky edge cases: - token leakage - inconsistent results Here's what I learned and the solution that finally worked.