require client jwt bearer authentication to verify access tokens