draft of client secret JWT authentication