feat(auth): remove jwt from javascript

[dargmuesli]

The JWT should not be available to JavaScript.

See:

• feat: evaluate redis for session storage stack#89 if moving to session ids, the jwt would not be stored at all