Securing a REST API with JWT, code