code: func (k *Kite) AuthenticateFromToken(r *Request) error {
  	k.verifyOnce.Do(k.verifyInit)
  
  	token, err := jwt.ParseWithClaims(r.Auth.Key, &kitekey.KiteClaims{}, r.LocalKite.RSAKey)
  
  	if e, ok := err.(*jwt.ValidationError); ok {
  		// Translate public key mismatch errors to token-is-expired one.
  		// This is to signal remote client the key pairs have been
  		// updated on kontrol and it should invalidate all tokens.
  		if (e.Errors & jwt.ValidationErrorSignatureInvalid) != 0 {
  			return errors.New("token is expired")
  		}
  	}
  
  	if err != nil {
  		return err
  	}
  
  	if !token.Valid {
  		return errors.New("Invalid signature in token")
  	}
  
  	claims, ok := token.Claims.(*kitekey.KiteClaims)
  	if !ok {
  		return errors.New("token does not have valid claims")
  	}
  
  	if claims.Audience == "" {
  		return errors.New("token has no audience")
  	}
  
  	if claims.Subject == "" {
  		return errors.New("token has no username")
  	}
  
  	// check if we have an audience and it matches our own signature
  	if err := k.verifyAudienceFunc(k.Kite(), claims.Audience); err != nil {
  		return err
  	}
  
  	// We don't check for exp and nbf claims here because jwt-go package
  	// already checks them.
  
  	// replace the requester username so we reflect the validated
  	r.Username = claims.Subject
  
  	return nil
  }
docs: // AuthenticateFromToken is the default Authenticator for Kite.