code: public String createToken(final Principal principal, final List<Permission> permissions) {
          final Date today = new Date();
          final JwtBuilder jwtBuilder = Jwts.builder();
          jwtBuilder.setSubject(principal.getName());
          jwtBuilder.setIssuer(ISSUER);
          jwtBuilder.setIssuedAt(today);
          jwtBuilder.setExpiration(addDays(today, 7));
          if (permissions != null) {
              jwtBuilder.claim("permissions", permissions.stream()
                      .map(Permission::getName)
                      .collect(Collectors.joining(","))
              );
          }
          return jwtBuilder.signWith(SignatureAlgorithm.HS256, key).compact();
      }
docs: Creates a new JWT for the specified principal. Token is signed using
  the SecretKey with an HMAC 256 algorithm.
  
  @param principal the Principal to create the token for
  @param permissions the effective list of permissions for the principal
  @return a String representation of the generated token
  @since 1.1.0