JWT is received as POST param, not as query string