very basic jwt authentication on the server