refactor from jwt-simple to jsonwebtoken and add 2week expiration