Allow  JWT  or username/password authentication