jwt headers work