jwt io invalid signature