JWT payload and header with indifferent access