Base64url encoding uses '_' as a valid character, so splitting the JWT
token on '_' would intermittently break the JWT parsing when the encoded
payload or signature contained underscores. Strip the known prefix instead.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>