jwt auth/sessions, signup fixed