}
@Override
protected Principal authenticate(Request request, Jwt jwt) throws JwtUserRejectedException {
// we don't do any further validation of the user here. If the host vouches for them then ok by us
return jwt.getSubject() == null ? null : new SimplePrincipal(jwt.getSubject());
}