- switch to milliseconds for iat and exp to avoid timezone problems
- create proper validators for subjectToken and verificationToken jsons
- check for expiry of verificationToken
- in test mode, verification pin is always "123456"