base64URL decode the sig of JWTs before verifying

The preverified token verifier was expecting the signature portion to be hex encoded, which is incorrect.
Fixes #823
Merge pull request #824 from mozilla/issue-823

base64URL decode the sig of JWTs before verifying
fixed #825 preverifytoken exp seconds
train-23
/account/destroy can throw an "incorrect password" error
Merge pull request #827 from fmarier/destroy_incorrect_password

/account/destroy can throw an "incorrect password" error