I get a valid JWT back even when it should be invalid

Question

I am trying to set up authentication for my HTTP requests. The problem is that any user who logs in is able to modify and delete posts in my SQL database. I am trying to val