Pulling out and parsing the querystring doesn't seem relevant to the `Transaction` model. Perhaps this method shouldn't even exist and the app should just set the JWT on the model.