"On successful login two cookies will be created:

    jwt - A "JSON Web Token" (JWT) containing profile information and the respective access tokens (Twitter/etc). http-only!
    profile - A JSON string which containing non-sensitive information (accessible from browser JS):
        username - string / mandatory, the account specific user alias (e.g. Twitter name)  - photo - string / optional, the account specific user image link
        name - string / optional, the "real" name

" This looks like just enough rope to hang oneself. If you check only the profile variable it could easily be set by the user herself. So I guess you need to check the jwt. I guess it makes more sense if this would be run as reverse proxy so the cookies can't be tampered with.