first cut at a JWT-based authentication policy

Yup.