Every time a protected url is called i check for req.user that is set up automatically by the JWT middleware.

Now I'm wondering:

1 - where does JWT tokens are stored when calling sign() ?

2 - do i have to verify() the token every time a protected url is called? if yes why?

3 - When i set a new token for an already signed user does the old token (if exists) gets deleted ? What if the expiration is not been set up or is 5 years for example?

4 - Why can't I set new tokens on same browser/app page ? I get invalid signature error if i register a new token but the token matches (i checked) It's like I can't signin more than 1 user on same browserstrong text