working single sign-on with goonauth; sends JWT to client