this is part of the [JWT spec](http://tools.ietf.org/html/draft-ietf-oauth-jwt-bearer-04#section-4)