use jwt for the auth stuff, still just playing around