And here it goes the eternal battle on whether JWT are a good solution for authentication or not.

jwt is delegating it to someone else right? who might be you (a second service) but someone needs to check a password somewhere