iron (https://hapi.dev/module/iron/) is a solid alternative to JWT (with JWE) to handle authentication in SPA.