server: add missing express-jwt