jwt io says invalid signature