made it rely on jwt payload, fixes #7 and resolves #8