finished JWT auth