Continued session-less auth. Added a new passport strategy and protected all routes except for /, /login and /singup with express-jwt