fix(jwt-auth): real_payload was overridden by malicious payload (#10982)

fix(jwt-auth): real_payload was overridden by malicious payload (#10982) #66