Decode private claims when decoding a claim set

This puts all claims that are not set on ClaimSet into PrivateClaims.
This is not strictly correct as there are a number of registered claims
that are not used by this library.
Add function to validate a JWT

Inside the Validate function:
- Only supports RS256 and RS512 algorithms
- Verifies signature, expiry and audience
- Does not verify 'not before' or usage before issue time

Outside the Validate function:
- The setting of the iat and exp fields has been changed so that Exp can
  be overriden. The behaviour is the same when nothing is set, but if Exp
  has been set it will be used.
- Add the Kid field to the Header struct. This is so that JSON Web Keys
  can be looked up in a JSON Web Key set.

Conflicts:
	jws/jws_test.go