store jwt in cookie