Some fixes to token decoding

[jsumners]

Description

This PR tweaks a couple of items in the decoding of web tokens.

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not master

[panva]

@jsumners the change is lacking test coverage and also, can you provide more background the change in general?

[jsumners]

I suppose a direct test for checking if isObject picks up [] or 42 could exercise this PR. But it'd ultimately be checking a well known JavaScript pattern so I don't see much utility in it. Otherwise, I would hope the existing test suite already covers this.

More background would require using a webform and process I don't want to deal with.