JWT decode

Inspect JWT header and payload (no signature forge).