It's the other way round - the front-end shouldn't need to read JWTs, just pass them on.