Pass access/refresh claims to session for claim verification

[floriandejonckheere]

As of JWT 2.9, token claims that do not pass verification raise an error. JWT 2.8.2 did not display this behaviour. Since jwt_sessions did not pass the token claims, verification always fails (when it's enabled).

# jwt 2.8.2
JWT.decode(token, "secret", true, verify_iss: true)
# => [{"exp"=> ...

# jwt 2.9.0
JWT.decode(token, "secret", true, verify_iss: true)
# => Invalid issuer. Expected [], received issuer (JWT::InvalidIssuerError)

JWT.decode(token, "secret", true, verify_iss: true, iss: "issuer")
# => [{"exp"=> ...

The same applies to both verify_iss and verify_aud.