fix: validate session JWT structure during parsing and validating

messages.go

@@ -294,6 +294,9 @@ func ParseRequestorJwt(action string, requestorJwt string) (RequestorJwt, error)
 	if _, _, err := new(jwt.Parser).ParseUnverified(requestorJwt, retval); err != nil {
 		return nil, err
 	}
+	if err := retval.RequestorRequest().Validate(); err != nil {
+		return nil, errors.WrapPrefix(err, "Invalid JWT body", 0)
+	}
 	return retval, nil
 }