Infer algorithm from header

[JoeWoodward]

Is there a reason to not infer the algorithm?

The information for which algorithm was used is in the header. Why not use that information instead of requiring the programmer defines it in the options hash

[ab320012]

its a security concern to let client dictate algo without validating on server: check out the section: RSA or HMAC? and Recommendations for Library Developers https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

[excpt]

@JoeWoodward Due to security concerns the algorithm is not fetched from the header of an incoming token for verification.

More on that topic in these PRs / issues:

Code changed in #184

Explained in more detail here #107, #226