pub fn decode_header(token: &str) -> Result<Header, JwsError>
Parse the (unverified!) header segment. Never make a trust decision from this alone.