add some optional claims validation

[glehmann]

this is restricted to boolean claims.

Note: the code is not ready to merge - it is rather a way to open a discussion on this kind of feature and the best way to implement it

[glehmann]

In fact a much better approach might be to provide an entry point to implement these claim checks. Either by subclassing the jwt authenticator, or by providing a callback. What do you think?