what is jwt token authentication | attacking jwt for beginners