jwt io invalid signature hs256