jwt io gives invalid signature