Implement JWT tokens for authenticating requests
Read JWT token from Authorization header
Decode and verify the JWT into the userId
Get the user with the userId, or return anonymous user
Generate token on login and send to client with X-Set-Authorization header and 204
Remove powered by Koa header