api: rm unused variables - jwt, crypto, secret