Issuing Access Token as JWT - comments