I think, like you mentioned, JSON web tokens can definitely be a good alternative in this case. I've used for a few small projects and haven't had any issues. Certainly not an expert on them, but I haven't seen much downside. The only I can really think of is if you like analyzing token usage/patterns on the server-side, but not sure how common that is.

// someone else implement this baby: