#4 - Handle invalid JWTs gracefully