The user should be logged in even when they close the site for under an hour. The application should check with each request if the JWT token is valid or expired and log the user automatically out if the token is expired.
Currently the session is 1 hour long. Can be extended if needed.