I see.  I would recommend putting the JWT validation logic in `validateTokenData`, and the Client validation logic in a new method defined in the `ClientAssertionType` interface.  Remember, this interface should be generic and implemented for HttpBasic, which is the default. Something like: 

`getClientDataFromRequest` - pull the client data from the request
`validateClientData` - assertion logic

The method `getTokenDataFromRequest` should simply return an array of relevant information.  It should only return false if the data cannot be gathered, but it should not perform any validation (such as expiration checking)