Return correct error if JWT expired
Set @current_user correctly
Handle requests correclty without auth header/param
Link log dir to /log