(feat): Validate JWT to prevent XSRF attacks on Pro Domains

Is this a bug? Make sure to use the Bug template above and be as detailed in your report as possible.