add an mvc api and show JsonWebTokenValidationAttribute usage