Adds more unit testing

Some basic security check for tempering of JWS.

jwt/jws.go

@@ -80,9 +80,9 @@ func isBase64URLEncoding(b byte) bool {
 }
 
 // DecodeJWS decode an object encoded with the JWS serialized fromat
-// as specified by RFX 7515. to avoid an attack where the unprotected
-// JOSE header would contain a tempered signing algorithm, the Signer
-// should also be specified.
+// as specified by RFC 7515. to avoid an attack where the unprotected
+// JOSE header would contain a modified alg field, the Signer should
+// also be specified.
 func DecodeJWS(data []byte, v interface{}, s Signer) error {
 	var headerLength, payloadLength int
 	for i, c := range data {