in play-v29/src/main/scala/com/gu/googleauth/auth.scala [139:144]
private def parseJwtClaimsFrom(oauthAntiForgeryState: String) = secretsProvider.snapshot().decode[Try[Jws[Claims]]]({
sc => Try(Jwts.parserBuilder().setSigningKey(keyFor(sc)).build().parseClaimsJws(oauthAntiForgeryState))
}, conclusiveDecode = {
case Failure(_: jsonwebtoken.security.SignatureException) => false // signature doesn't match this secret, try a different one
case _ => true
}).getOrElse(Failure(new jsonwebtoken.security.SignatureException("OAuth anti-forgery state doesn't have a valid signature")))