Decode JWTs, inspect claims, and optionally verify HS256 signatures.
Decode header and payload, inspect timing claims, and verify HS256 signatures.