I don't think you need to CEF log this. This would not mean that an attacker is poking around it would mean that our code is really really buggy :) At this point in execution, the JWT signature is valid so getting this far means webpay or marketplace blundered contrib_uuid somehow. Raising the exception should be good enough for us to catch it.