refactored from jwt-simple to jsonwebtoken and added 2week expiration

extract the magic number to a constant:

    // in minutes
    var TWO_WEEKS = 60 * 24 * 14;