more about security - personalized components will receive jwt signed to the component endpoint with the component's lexicon as the lxm. this lets you e.g. serve private-ish data like poll results - for writes or third party reads you'll have to have your own login. you'd still validate by jwt