web authentication encryption jwt hmac amp oauth with go