protected function validatePayload($nonce, \stdClass $payload, $now = null, $leeway = 0)
    {
        $now = $now ?: time();
        $violations = [];

        if ($payload->exp + $leeway <= $now) {
            $exp = date(\DateTime::ISO8601, $payload->exp);
            $violations[] = new \InvalidArgumentException('Token already expired at '.$exp);
        }

        if ($now + $leeway < $payload->iat) {
            $issuedAt = date(\DateTime::ISO8601, $payload->iat);
            $violations[] = new \InvalidArgumentException('Cannot handle token prior to '.$issuedAt);
        }

        if ($payload->nonce !== $nonce) {
            $violations[] = new \InvalidArgumentException('Nonce mismatch');
        }

        return $violations;
    }