Add broken JWT signature validation
Remove disclaimer
Cheat on signature validation

The problem might stem from atob()
not returning a base64url-encoded string.