cache results of verify and decode (#1)

Correct issued at

If we dont have enough jwt parts, jwt is invalid

check format of payload to decode

Return URLs for configuration

Correct cookie name, and provide constant for insecure cookie

Notification Handler