Validate JWT for proper authentication

This patch introduces a `key` callback, which is used to load the keying material needed to verify the assertion.  The JWT is then actually verified using this key, and authentication proceeds if the assertion is valid and fails if it is not.

This fixes #6, and is critical for security.

I have not yet had the chance to update (and expand) the test cases.