in a state less auth layer you can't do blacklisting of token. hence if your security requirement are somewhat in the "safer" ranger. you will need to use a bit of state to whitelist or blacklist tokens.