Move JWT functions into their own file with tests
Stub out RefreshToken
Catch signin with bad email