Don't assume secrets are Base64 encoded

The JOSE/JWT specs make no assumption that shared secrets are Base64 encoded. If a particular caller's secret needs to be decoded prior to verification, then it's its responsibility to take care of that.