Add a verify(token, algorithm, verificationKey) method as per this posting regarding vulnerabilities in jwt: https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/

[nethermead]

No description provided.

[nethermead]

It's good that you don't support the 'none' algorithm as per the JWT spec, but if the algorithm used can't be enforced by the server, exploits are feasible.

[thedufer]

Looks like this can be closed as per #16

[benbotto]

Passing the algorithm should be shown in the readme, which someone has already recommended in #16. (In my opinion passing the algorithm should be required.) This issue caused a fairly severe security hole in my application because I use RS256.