API Route доступен с любым токеном JWT + PASSPORT

Я строю api для своего приложения и пытаюсь использовать паспорт jwt. Я могу зарегистрировать новых пользователей и войти (получить маркер назад), но когда я использую Postman для проверки "защищенного" маршрута, я могу использовать любой токен, как это "any any" Pasport.js

const   JwtStrategy = require('passport-jwt').Strategy,
        ExtractJwt = require('passport-jwt').ExtractJwt;

const   User = require('../api/models/user/userModel'),// load up the user model
        config = require('../config/database'); // get db config file

module.exports = (passport)=> {
    let opts = {};
    opts.jwtFromRequest = ExtractJwt.fromAuthHeader();
    opts.secretOrKey = config.secret;
    passport.use(new JwtStrategy(opts, function(jwt_payload, done) {
        User.findOne({id: jwt_payload.id}, (err, user)=> {
            if (err) {
                return done(err, false);
            }
            if (user) {
                done(null, user);
            } else {
                done(null, false);
            }
        });
    }));
};

Server.js

const   express = require('express'),
        app = express(),
        port = process.env.PORT || 3000,
        mongoose = require('mongoose'),
        morgan = require('morgan'),
        passport = require('passport'),
        bodyParser = require('body-parser'),
        jwt = require('jsonwebtoken'),
        config = require('./config/database'),
        Event = require('./api/models/event/eventModel'),
        User = require('./api/models/user/userModel');


mongoose.Promise = global.Promise;

mongoose.connect(config.database);

app.use(bodyParser.urlencoded({ extended: true }));
app.use(bodyParser.json());

app.use(passport.initialize());

/* Routers registration */

const routesEvent = require('./api/routes/event/eventRoutes');
routesEvent(app);

const routesUser = require('./api/routes/user/userRoutes');
routesUser(app);

/* END Routers registration */

/* Express middleware
 * which used to return more interactive messages */

app.use((req, res, next)=>{
    res.status(404).send({url: req.originalUrl + ' not found'});
    res.header("Access-Control-Allow-Origin", "*");
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
    next();
});

/* END Express middleware */

// Launch the server on port 3000
const server = app.listen(3000, () => {
    const { address, port } = server.address();
    console.log('RESTful API server Listening at http://${address}:${port}');
});

EventRouter.js

const   jwt = require('jsonwebtoken'),
    passport = require('passport');

require('../../../config/passport')(passport); // as strategy in ./passport.js needs passport object

module.exports = (app)=> {
    const event = require('../../controllers/event/eventController');

    // Routes
    app.route('/events' )
        .get( event.list_all_events, passport.authenticate('jwt', { session: false}));

};

EventController

const   mongoose = require('mongoose'),
        Event = mongoose.model('Events'),
        getToken = require('../../../config/getToken');

exports.list_all_events = (req, res)=> {
    let token = getToken(req.headers);
    if(token){
        Event.find({}, (err, event)=> {
            if (err)
                res.send(err);
            res.json(event);
        });
    } else {
        return res.status(403).send({success: false, msg: 'Unauthorized.'});
    }

};

Я определенно делаю что-то неправильно в контроллере или в этом файле
GetToken.js

module.exports = getToken = (headers)=> {
    console.log(headers);
    if (headers && headers.authorization) {
        let parted = headers.authorization.split(' ');
//Here I can see my Token from the Postman
        if (parted.length === 2) {
            return parted[1];
        } else {
            return null;
        }
    } else {
        return null;
    }
};

Пожалуйста, любые идеи о ошибке, которую я делаю выше?