I wanted to enable JWT access to the blueocean APIs so I read the security section in the README which says to set a system property, which I did as you can see in the screenshot. After doing this and even restarting Jenkins nothing changes (the system property is there even after restart). The blueocean dashboard still uses cookies. You can try this for yourself by running 

docker run --rm -p 8080:8080 -p 50000:50000 --env JAVA_OPTS="-DFEATURE_BLUEOCEAN_JWT_AUTHENTICATION=true" jenkins/jenkins:latest