Auth0 Hack: JWT’s aren’t as great as claimed…. and why it took six months to fix