The number of times I have had to remind a developer that the contents of the JWT are readable is nuts. Way too often they want to treat it like a general session store and just toss any old state in there regardless of if the end user should be able to see the value.