What data should be include into the JWT token, and what should be avoided to ensure security? Currently, the token includes the username, role, iss, aud, and exp
