Decode tokens, validate time-based claims, and verify HMAC signatures.
Header
--
Payload
Signature
Signature not verified yet.
Claims
No claim check performed.