Allow 'anonymous' JWTs - pass in null key to generate and verify