Added two further checks for the JWT and the JWS

[PhilipSkinner]

trafficstars

Added in a the recommended check for validating the time the JWT was issued against the expiry time - probably to deal with machines with different clocks.

Added in the recommended check to ensure there is an algorithm provided in the jose header, though this does not check the signing thumbprint against those that can be read from the well known endpoint.

[jaredhanson]

This PR isn't diff'ing cleanly. I'll attempt to review this and merge by hand.