base64URL decode the sig of JWTs before verifying

The preverified token verifier was expecting the signature portion to be hex encoded, which is incorrect.
Fixes #823