Support JWT in cookies

## The goal

We want the developer to have the same quick onboarding experience even if they want to use cookie for their website.

## JWT access token

We currently support issuing access tokens in JWT. The developer can just verify the JWT and trust the claims inside it as long as the JWT is not expired. The lifetime of the access token can be made short enough, say 5 minutes, so that revocation of the refresh token can be reflected within 5 minutes.

## Difficulties in using JWT in cookie

When access token and refresh token is used, the SDK has mechanism to refresh the access token before it is expired. This is possible because the token endpoint response has `expires_in`. When cookie is used, the cookie is HttpOnly so it is not accessible to the SDK. We need to communicate the expiration in a separate channel.

When cookie is used, currently it is perfectly fine use the SDK for authentication only. The browser will include the cookie for subsequent requests. If we introduce a new way in the SDK to refresh the cookie periodically, this assumption will be broken.

If we make the JWT expiration the same as the session, then the JWT would have a very long expiration. If the developer blindly trust the JWT, they will very highly get stale results. They will definitely complain about the following case. The admin revoked a session of a user, but the user can still use the application. It would be too easier for the developer to make serious mistakes.

## What about Paseto

[Paseto](https://github.com/paragonie/paseto) is specification of token that aims to eliminate the misuse of JWT, JWS and JWE. We can think of it as a carefully selected profile of JOSE, so that anyone using it is free from the vulnerability of using JOSE incorrectly. Therefore, Paseto itself cannot solve our problem. Here is the quote from the README of Paseto

> Caution: Neither JWT nor Paseto were designed for stateless session management. Paseto is suitable for tamper-proof cookies, but cannot prevent replay attacks by itself.