code: function signToken(id, role) {
    return jwt.sign({_id: id, role: role}, config.secrets.session, {expiresInMinutes: 60 * 5});
  }
docs: Returns a jwt token signed by the app secret
  @param {String} id - Id used to sign a token
  @return {String}