thanks, @Tom. I think I figured out the issue. the authentication request in the setup is included in http_req_duration. when i commented out the setup function and hardcoded the JWT in the headers, http_req_duration was closer to what i get in my bash script.
is there anyway to igore http calls made in the setup? i found this online: Ignore http calls made in Setup or Teardown in results? - #2 by nedyalko