Change client secret header and return 401 on invalid jwt

[AiAe]

Since nginx (to my surprise) has underscores disabled as valid headers, we have to check for dash instead.

• fix to return 401 on invalid jwt instead 500