title: JWT Token-based authentication and concurrent "session" limiting
body: <p>We're building an API (PHP Laravel) that will serve a few different clients (web, windows desktop, and later ios/android). We're just starting to tackle the authentication portion and JWT seems like a good fit so far. Because of the sensitive nature of our application, we want to limit the amount of concurrent sessions a single user can have. This "limit" is dynamic depending on the API endpoint being accessed. </p>
  
  <p>So far, we have the token being refreshed on every call. I'm thinking about putting the blacklisted tokens into Redis Cache as well as the user's current "refreshed" valid token. So, if the user (or impersonator) tries to login and there is an existing, valid token, they won't be able to login. The first "session" has to log out which will blacklist the current token and clear the "valid" token; allowing a new "session" to begin. If 2 or 3 sessions are required, maybe we can stoe X valid tokens.</p>
  
  <p>Is there a better strategy for this? Or any suggestions to improve?</p>