code: func (j *jwtTokenAuthenticator) hasCorrectIssuer(tokenData string) bool {
  	parts := strings.Split(tokenData, ".")
  	if len(parts) != 3 {
  		return false
  	}
  	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
  	if err != nil {
  		return false
  	}
  	claims := struct {
  		// WARNING: this JWT is not verified. Do not trust these claims.
  		Issuer string `json:"iss"`
  	}{}
  	if err := json.Unmarshal(payload, &claims); err != nil {
  		return false
  	}
  	if claims.Issuer != j.iss {
  		return false
  	}
  	return true
  
  }
docs: // hasCorrectIssuer returns true if tokenData is a valid JWT in compact
  // serialization format and the "iss" claim matches the iss field of this token
  // authenticator, and otherwise returns false.
  //
  // Note: go-jose currently does not allow access to unverified JWS payloads.
  // See https://github.com/square/go-jose/issues/169