Function decode_unverified_claims 

pub(crate) fn decode_unverified_claims<T>(
    token: &str,
) -> Result<T, AuthenticationError>
where
    T: DeserializeOwned,

decode untrusted JWT claims for candidate room selection only

callers must verify the same token with the selected room key before using the decoded claims as authenticated identity or permission data