Verify JWT

Verify HS256 JWT signature and expiry locally.