Returns the payload of a session token whose signature and expiry are valid, or null. Call authenticate (lib/auth.ts) instead, which also checks the token against its user.