In ```JwtTokenUtil``` the **SIGNING_KEY** value is hard coded. This should instead be moved to application.properties so it can be site-configurable.