use jwt to verify accessToken