it's a bit weird, but JWTs always arrive as GET parameters. I don't know why we did that, heh. It's frozen on the platform forever now.