return header with payload when decoding token

[krisztian-toth]

Would be nice if the header would be included in the JWT#decode method. If not, it'd be convenient to have a get_unverified_headers method on the JWT class.

[klausmyrseth]

I vote for the latest so its possible to match keys before verification/decode.