authentication fixes and cleanup

get JWT token from a header
fix generation of JS validation message
fix error span for reference fields
eslint fixes
use regexp paths for guests