JWT Authentication for REST API
Though not in Javascript, my uses of JWT have always used the password as the JWT secret.  The JWT payload is whatever you need to identify the user -- username in your case.  You can add in a CSRF token of some sort as well.  I have an example on my GitHub that is a very simple application using JWT as the authentication mechanism - https://github.com/dave-shawley/readings/blob/7d2504587daa6a174fc3cbc0a5478fa817412eea/readings/static/js/login.js#L10-L26 is the javascript login code.  Mind you that I am most certainly not a javascript programmer so don't read too much into my example for style advice ;)

My login code builds a JWT payload that looks something like:

{
  "exp": 1488027170,
  "iss": "https://whatever.example.com/login",
  "csrf": "123456ABCDEF",
  "nbf": 1488026870
}


where "nbf" is the current time, "exp" is the expiration time, and "iss" is the referring web site.  "csrf" is a one-time token that is embedded in the HTML form.

I encode this structure using the entered password as the secret and pass the resulting token to my login endpoint.  I have the user name in a secured cookie but it could be passed in the JWT payload as well.  On the receiving side, I look up the user information in my data store by the user name from the cookie.  Then I verify that the JWT payload was signed using the password as the secret and that it is still valid.  If everything checks out, then the user is authenticated.