createJWT(payload: Omit<AuthPayload, "exp">): Promise<string>
Signs a session token carrying payload, valid for 7 days.
issueTokens issues it on sign-up, sign-in and password change, and
the client sends it as a bearer token.
payload: Omit<AuthPayload, "exp">