Patch over an apparent problem in clj-jwt.

Having added tests to check that we do not accept bad tokens, it became
apparent that clj-jwt `verify` function will accept a token which has
not actually been signed, returning true, even though the signature
field is empty. Will need to investigate further.