DMO-773 Fix JWT signature verification
DMO-773 Fix JWT signature verification

Do not use the SignedHash for verifying signatures as it doens't work
well with tokens created by non-ruby JWT libraries. The issue is that
the header fields are not sorted during JSON marshaling and the
signature verification expects it to have the `typ` key first. The logic
is merely a copy paste of what the SignedHash used to do but we don't
try to re-compute the plaintext from the decoded cookie. We simply take
the first two components of the cookie and use it as a plaintext so the
ordering doesn't matter.

rightscale/global_session,rightscale/global_session