JWT authentication bypass via `X-HTTP-Method-Override` header - eviltoast