Upgrade JWT to 1.5.6

[krallin]

The two major API changes here are:

• We can specify the algorithm to use when decoding (which is important from a security perspective, although it hasn't affected us).
• JWT.decode now returns [payload, header] as opposed to just the payload.

---

cc @fancyremarker