Move the apply filter for jwt_auth_valid_credential_response

[chrisladams]

I moved the apply_filters( 'jwt_auth_valid_credential_response') to below the refresh token generation so a user can append the json output with relevant data.

[sun]

Hey, thanks for contributing your improvement!

I'm concerned that this changes what is contained in the value that is passed to the filter hook callbacks. This would break existing sites that are using the filter already?