stateless 1 Roles changed, but the old ones kept working for 30 minutes: putting a permission version in the JWT Nov 3, 2026