refactor jwt impl for allow extensions.