client side jwt auth