Adding JWT verifier.

Still missing:
- Caching of the already checked JWTs (although it could be done at an
  upper layer).
- Caching of the jwks_uri to avoid 2 roundtrips for each verification.