the jwt lib updated to 2.0 with breaking changes. the requirements.txt doesn't lock down any dependency...