nostr devs hate jwt. I wrote my original APIs to use that because it's obviously better for user signing experience.. I have since capitulated to nip98. What replay attack are you experiencing?