JWT Security: What Developers Get Wrong (And How to Test It)