as a general question: how are jwts invalidated in supertokens?