Reevaluate added dependencies

[m-mohr]

We added joserfc and starlett dependencies to avoid upstream or security issues. We should reevaluate in a week or two whether we can get rid of those if upstream fixes it.