Expect token components to be base64url-encoded

We were decoding them as normal base64, but every version of
draft-ietf-oauth-json-web-tokens has specified base64url.