I am using postgREST which allows you to use JWT claims to store role information that associates directly with database roles so you can get use Row Level Security on all app users. I may be able to get it to work another way though. Using verifySession seems easier anyways.