Suggested Changes/Updates

[calebkleveter]

1. After the change, JWTVerificationMiddleware is essentially the same as JWTStorageMiddleware.
   The differences I see: it's non-generic, uses JWTService.verify instead of JWT.verify, and doesn't touch the request's private container. That's pretty redundant, maybe it could be removed altogether.
   (That being said, I don't know the purpose of JWTService.)

2. The Authorization header missing usually doesn't result in a 400 Bad Request error, but 401 or 403 (depending on the school one subscribes to).
   I'm leaning towards 401 myself. (Also for the invalid token case.)

3. This is more of a vapor/jwt thing probably, but it would be pretty rad to have an RFCPayload struct that contains all the standard claims (https://tools.ietf.org/html/rfc7519#section-4.1) as Optionals, and can verify them automatically, if they are present in the payload.