Verify the input JSON, don't re-gen it

Python dict keys are in an undefined order, which means json.dumps()
doesn't reliably produce the same string.  So in JWT, it's best to
verify the input JSON, rather than decoding it, re-encoding it, and
verifying it.  Otherwise you get spurious verification failures.