+ it rfc arc jwt Refresh token good practice: always send it in header/cookie? wono | tweet Add comment Do you want to delete? YesNo