quote from go jwt lib: "WithPaddingAllowed will enable the codec used
for decoding JWTs to allow padding. Note that the JWS RFC7515 states
that the tokens will utilize a Base64url encoding with no padding.
Unfortunately, some implementations of JWT are producing non-standard
tokens, and thus require support for decoding."
cognito is one of those...