Cant we just use one blacklist table to do the job? Also why are we storing refresh token if we just use jti claim to lookup the blacklist?