refactored jwt validation, addresses #23 and #34