change how the auth works, now using jwt and http bearer