[WIP] jwt auth support