no longer sending password in JWT, also fixed static server directory