Modifies the getJWT function to return undefined if the token has expired.  This gives you a quick way of knowing if the user is (more than likely) authenticated without having to make a request.

This adds an `app.decodeJWT` function that decodes a token synchronously.  With a non-expired token, it returns the token payload, otherwise it returns undefined.

Will need docs before publishing 0.8 or whichever version we’re doing next.

…rs-permissions (#307)

The only difference is that verifyJWT and getJWT are sync, so they don’t return promises.