Add jwt decode to psa auth manager and rework scope checking