If you copy and paste only part of a token then a general DecodeError is
raised. It's the parent class for all other related errors like for
expired signatures.
Now we just fail authentication instead of raising a server error.
Services are usually not namespaced because they are part of the app.
This engine has an isolated namespace which means that we don't need to
separate with out own namespacing here.
