[snarfed]so I'm considering allowing missing exp too, even though it's a MUST. so I'm wondering, if I have replay prevention based on single-use jti, and I require iat and check its freshness, is my security posture roughly equivalent with or without exp?
