JWT decoder

Decode payload only — does not verify signatures.