The issue isn't tokens getting created on login, it's them getting validated on every request. That's already 40-50ms, even without the db hit each time.