make sure the token signing method is one we expect.
adding auth/signin and auth/signup api endpoints.