return the string encoded JWT to the client, don't wrap it in a magic object...

return the string encoded JWT to the client, don't wrap it in a magic object as it might guide developers into trusting something that is untrustworthy.  closes #33