refactored from jwt-simple to jsonwebtoken and added 2week expiration