it might also be good to add a "sanity check" test that does a POST and makes sure a JWT is returned for both in-app and app but I don't think that needs to go through all the details like checking JWT claims.