(major) switch to jwt authentication