basic auth working, starting to use jwt for token signing