def decode_at_reference_time(auth_header, reference_time)
    unless auth_header && (tkn = auth_header.split(' ')).length == 2 && tkn[0] =~ /^bearer$/i
      raise InvalidTokenFormat, "invalid authentication header: #{auth_header}"
    end
    reply = self.class.decode(tkn[1], @options)
    auds = Util.arglist(reply[:aud] || reply['aud'])
    if @options[:audience_ids] && (!auds || (auds & @options[:audience_ids]).empty?)
      raise InvalidAudience, "invalid audience: #{auds}"
    end
    exp = reply[:exp] || reply['exp']
    unless exp.is_a?(Integer) && exp > reference_time
      raise TokenExpired, "token expired"
    end
    reply
  end
def decode_at_reference_time(auth_header, reference_time)
    unless auth_header && (tkn = auth_header.split(' ')).length == 2 && tkn[0] =~ /^bearer$/i
      raise InvalidTokenFormat, "invalid authentication header: #{auth_header}"
    end
    reply = self.class.decode(tkn[1], @options)
    auds = Util.arglist(reply[:aud] || reply['aud'])
    if @options[:audience_ids] && (!auds || (auds & @options[:audience_ids]).empty?)
      raise InvalidAudience, "invalid audience: #{auds}"
    end
    exp = reply[:exp] || reply['exp']
    unless exp.is_a?(Integer) && exp > reference_time
      raise TokenExpired, "token expired"
    end
    reply
  end
Returns hash of values decoded from the token contents,
 taking reference_time as the comparison time for expiration. If the
 audience_ids were specified in the options to this instance (see #initialize)
 and the token does not contain one or more of those audience_ids, an
 AuthError will be raised. AuthError is raised if the token has expired.
 @param [String] auth_header (see Scim.initialize#auth_header)
 @param [Integer] reference_time
 @return (see TokenCoder.decode)