fix(jwt-auth): real_payload was overridden by malicious payload

fix(jwt-auth): real_payload was overridden by malicious payload #8958