Reading up on the VerifyJWT policy, I see where you can't add iat, nbf, and exp as additional claims but I don't see any set attributes for them either (like audience, subject, iss). Are these verified by default? I just want to confirm I don't need ...