JWT inspector

Decode a JWT header and payload locally via the API. No signature verification yet.