Reject JWS with unprotected headers in `parseJWS`. (#37)
Reject JWS with unprotected headers in `parseJWS`. (#37)

This commit explicitly rejects any HTTP POSTS that arrive with
unprotected headers to `parseJWS`. Since go-jose strips these
unprotected headers in the result from `jose.ParseSigned` we
do a quick JSON unmarshal to test for the unprotected headers
ourselves prior to calling `ParseSigned`.
letsencrypt/pebble,letsencrypt/pebble,shred/pebble,letsencrypt/pebble,shred/pebble