Bug report: JWT Verify doesn't require an algorithm

As detailed [here](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/), JWT verification functions should require specifying the algorithm that should have been used, in order to prevent an attacker from changing the algorithm to a symmetric algorithm from an asymmetric one and using the public key to sign the token. Probably low priority for this particular app, but it would be good to at least have the option.

Start by locating the JWT verification functions and reviewing the linked Auth0 vulnerability discussion. Determine how verification currently selects an algorithm and define the expected behavior for requiring or explicitly allowing one. Done means verification prevents the described algorithm-switching risk and has coverage for the new behavior.

Written by the indexing model from the issue text.