Why Access Token Is Not a JWT (Opaque Token)