Per #8446, the JJWT library requires at least 32 bytes for the application secret (if using HMAC-SHA256) up to 64 bytes (if using HMAC-SHA512)

This traces down to the SecretsConfiguration:

https://github.com/playframework/playframework/blob/master/framework/src/play/src/main/scala/play/api/http/HttpConfiguration.scala#L65

but the parser does not specify a minimum length for the secret:

https://github.com/playframework/playframework/blob/master/framework/src/play/src/main/scala/play/api/http/HttpConfiguration.scala#L243

Amongst other things, upgrading the library means that "changeme" will no longer work as the secret with the JJWT codec -- which means we probably have to map it to something that does conform..