Read a JSON Web Token's header and payload. Decode only: it never verifies the token or sends it anywhere.