Oh, and we use asym because it's useful for us to be able to inspect the token (and see stuff like it's permissions and expiration client side). I only kinda mention this a bit later, but I might make that a bit clearer.