What is the recommended way to setup supertokens if we have one backend that is the api and another backend for frontend (nextjs that is not mutating the sessions but should get access token payloads)?