SECURITY BUG: when using alg none and secret is passed the library wasn't throwing an error

Repro:

``` js
var jwt = require('jsonwebtoken');
jwt.verify('eyJhbGciOiJub25lIiwiY3R5IjoiSldUIn0.eyJzdWIiOjEyMzQ1Njc4OTAsIm5hbWUiOiJKb2huIERvZSIsImFkbWluIjp0cnVlfQ.', 'secret', function(err, payload) { 
   // payload should be null and err should have an error
});
```

fixed here dfddaa4bf520f40051732b2a0dc8d525bd946763
