add some more (JOSE) tests
add TODO on preventing timing attacks

following new security considerations in JOSE specs
pass JSON objects in app HTTP headers as plain JSON
correct printout in hash comparison function and use apr_strnatcmp
release 1.5.2