Protecting APIs with JWT Validation