Your session lives on the server now, behind a cookie that carries an identifier and nothing else. It used to carry your access token, your refresh token, and the key they are bound to