I've wanted to build a similar system for supporting preview of articles on a CMS. Problem is, users may share multiple URLs with a user so a single JWT token in a cookie doesn't suit that flow very well. Each new link followed needs to extend an existing value with additional proofs (and remove old ones?)