added JWT signature verification