Before this can be used in any production system, explicit run time limits should be added. More information: https://github.com/biscuit-auth/biscuit/issues/53