use jwt correctly