Authorise AI agent tool calls from the JWT, not the prompt

An AI agent checked a valid JWT for customer 4821, then showed that customer someone else's orders. Nothing in the login broke. The token was valid the whole time. The customer typed one polite senten