My thinking here is... the client credentials still need to be verified... they're just not verified through the `getClientCredentials` method.  So we still need to check the credentials in the JWT token... no?