added framework for processing assertions for client auth
adapted keyfetcher to be more general
added jwt processing to client auth provider
wiring configuration
principal and audience are different (I thought I fixed this??)
updated custom filter
use sign-magnatude not twos-complement in key parsing
added NimbusDS
switched to nimbus to check JWT signature
genericized nimbus code, added caching