Brute forcing jwt tokens signed with HS256 since 2014