JWT (JSON Web Token) (in)security - research.securitum.com
https://research.securitum.com/jwt-json-web-token-security/
46800306