https://blog.soshace.com/securing-node-js-applications-with-jwt-and-passport-js/