Whitelisting jwt and enabling decryption of whitelisted addons

Core changes required for the JWT token PR.
@BanzaiMan if you want to clean it up, you need to move `if config[:addons]` to  the `delete_addons` method.
I tried to do that, but it triggers an issue in the specs when `:source` is null. Wasn't sure about the best way to fix that (not a ruby programmer).