json web token returns always 401 when has a bad token