This is kind of obvious when one thinks about it, but I didn't. Spent some time wondering why verify_aud didn't work. I could imagine someone not testing for verify_xxx failures and thinking everything works when verification in fact doesn't happen at all.
Possible fixes:
Croak if verify_xxx options are specified with decode_payload=0.
Add a mention about it in the POD under decode_payload.
This is kind of obvious when one thinks about it, but I didn't. Spent some time wondering why verify_aud didn't work. I could imagine someone not testing for verify_xxx failures and thinking everything works when verification in fact doesn't happen at all.
Possible fixes:
Croak if verify_xxx options are specified with decode_payload=0.
Add a mention about it in the POD under decode_payload.