It's the responsibility of both client and server to take more security precautions
Local storage exist across all browser tabs and restarts.  Session last only as long as browswer tab is open.
It's solves the problem that JWT's are forever.
A refresh endpoint is protected.
An expired jwt requesting a refreshed JWT would fail.
Set a callback to execute at a later time.
ClearTimeout clears a settimout.  It takes the set time variable as an argument.
1,2,3,4,6,7,
Industry standard protocol for authentication systems