hmm, doesn't this mean we have 2 ways to store additional data? one from session data and another through jwt payload? is one preferred over the other?