jwt exp & admin auth
added confirmation to user field and a few test