The access token Supertoken generates, is it a JWT? Or is it just a plain token that represents the user info? If the latter, does the token contain any sensitive info?