use jwt library, watch out for bad input to find