Also bump version to 9.21

We have a couple of places where JWT validation is needed, we should also review if these could be moved behind a common SPI allowing for a common implementation.