switch to jwt auth and now tokens work