When a Broken JWT Still Validates

A misunderstand for Base64 & Lenient Decoding