JWT validation

Depends on https://github.com/golang/oauth2/pull/17 
    
Inside the Validate function:
- Only supports RS256 and RS512 algorithms
- Verifies signature, expiry and audience
- Does not verify 'not before' or usage before issue time
    
Outside the Validate function:
- The setting of the iat and exp fields has been changed so that Exp can
  be overriden. The behaviour is the same when nothing is set, but if Exp
  has been set it will be used.
- Add the Kid field to the Header struct. This is so that JSON Web Keys
  can be looked up in a JSON Web Key set.