The Auth API has recently switched to a more secure shared-key signed
JWT to transmit user information to downstream services instead of a
plain JSON in order to allow the consumers to verify the token issuer.