https://s4yhii.github.io/posts/Attacking-JSON-Web-Tokens/