enable jwt checks on /submissions api