JWT authorization engine