update to jwt and api / app routes