jku_header_injection 2 Lab 04: JWT authentication bypass via jwk header injection Feb 19, 2026 Lab 05: JWT authentication bypass via jku header injection Feb 19, 2026