jwt io invalid signature es256