What is the difference between stateful JWT-based authorization with token blacklists and stateless JWT? What are the trade-offs in security and performance?