New blog published on this topic specifically:

http://gluu.co/jwt-not-authn