title: JWT / JSON Web Token: Safe to pass the token in the body on creation?
body: <p>I'm new to JWT. I have an endpoint for session creation. A request is made by my mobile app. Currently I have it so that when a user signs in successfully, I return the JWT in the Authorization Bearer header:</p>
  
  <pre><code>new_conn
  |&gt; put_status(:created)
  |&gt; put_resp_header("authorization", "Bearer #{jwt}") #&lt;-----------
  |&gt; render("show.json", session: user)
  </code></pre>
  
  <p>However, this is a little tricky to read from my client side. Is it safe for me to return it in the JSON response instead? </p>