verifyUserToken middleware uses AccessToken.verify method; always set iss on access tokens