json web tokens working on backend