I guess it's matching for 3 blobs separated by dots (ala JWT). Should probably check length and then verify the JWT.