Add params tests, stabilize success case

The JWT library (or possibly python) doesn't guarantee dict key/value
ordering, so encoding the token isn't guaranteed to result in the same
thing every time.