validate jwt token inside proxy