SPA + API: getTokenSilently not producing a JWT