initial work on api session handling using jwt