fn validate_registered_claims_at( claims: &RegisteredJwtClaims, now: Duration, ) -> Result<(), AuthenticationError>