How to people usually get around file downloads and initial page loads with JWTs (besides signed urls), since you can't control and preempt these requests to also send the JWT?