don't have multiple entityIds for attacks; use jwt tokens