jwt token setup + user api routes
header fixes