Returns the payload of a valid session token, or null. Besides the signature and expiry, it refuses a token whose user is gone or which predates a password change. The returned role comes from the database, not the token, since a token lasts 7 days and a role can change under it.