I was gonna tell you a UDP joke but you probably wont get it.

Yes it is possible, yes it isn't smart.

This is why you store the token on a cookie, so that the server can read it.

I use baobab and I hook it to react with baobab-react

Yes, you have to put a middleware in place that will be in charge of decrypting the JWT and marking a request as authenticated or not.

React seems like my best choice, thank you for your opinion!

In regards to your last point, it is not a valid argument. Not because a company uses X language, X language is the best option. If you give two persons the same pencil, I am sure one of them will make a better drawing than the other one, same applies for programming.And on a side note, Facebook built HHVM which reads php and compiles down to machine code and gets interpreted way faster on request.

I recommend splitting your bundle files in sections, I am sure that not every user from your site will visit every single page you have. (Admin pages, Support Pages, Etc). Split this bundles into sections of your site and load them as they visit.

Canvas!

There is a great performance in graphics. I use two 24" 1080p monitors plus the 13" retina display of the macbook pro early 2014. And before El Capitan, changing spaces and triggering exposé was slow and laggy, now it feels smoother than I thought it could ever get.