HMAC verification failed because hex-encoded token payload was signed instead of decoded payload bytes