Microsoft Titan JWT bug: Never use upn as a local username

A researcher reached an internal Microsoft service by setting a JWT's upn claim to admin. The missing signature was the door. The lookup key was the bug.