Changes: add authentication policy using jwt