fix security bug. JWT with alg none should fail if secretOrPulblicKey is passed
0.4.1