Relax validation a little, don't validate params that aren't there

I came across some issues using this library to validate the JWT's that come back from google OAuth 2.0. Specifically the Google JWT does not contain a `typ` header or an `nbf` claim. 

This PR patches it so that only the headers/claims are only checked if they exist.