I think this method should ensure at least signed_jwt isn't empty (#sign was called). Or make sign a before/after_create action.