added basic jwt server-side auth