Whitelisting jwt and enabling decryption of whitelisted addons

Core changes required for the JWT token PR.
Can we stay away from postfix conditionals? Makes the logic harder to follow.