Dojo challenge #52 Streamcore solution

Dojo challenge #52 Streamcore solution: the JWT handler trusts the unsigned 'kid' header before signature checks; path traversal reads /tmp/README.txt, whose contents sign an admin token.