Passwordless + JWT authentication