This seems to be a hard answer to find: with the api gateway approach to micro-servicing, Does the JWT or whatever token your working with thats sent to the gateway need to be passed to and from other services its acting on? Or are the services suppose to be behind a secure network that only the public gateway has access to ? Im trying to map out my first real take on this architectural approach and have had trouble finding support around this topic.