What does a 'self-signed' token mean? Why is a signature needed?