Addresses #7 & #8.

This pull request looks a little scary, but fixes the key issue that the `decrypt` function never validated the signature nor any of the claims.

In addition, the requirement of initialising the `Jwt` class with a `Header` object is quite strange when you consider decoding or decryption. I believe the key and algorithm should be derived from the actual token that is received instead of the code. Because of this, I have made the constructor optionally set the `Header`. In the instance of a `decrypt`, the `Header` object will be created on the fly using the information provided in the token.

To maximise code reuse, I have split the two requirements for verifying a signature, and validating claims into two parameters on the `decode` method. These both default to `true`.