base64URL decode the sig of JWTs before verifying

The preverified token verifier was expecting the signature portion to be hex encoded, which is incorrect.
Fixes #823
Merge pull request #824 from mozilla/issue-823

base64URL decode the sig of JWTs before verifying