Update text.

Author: jason-fox

README.md

@@ -481,6 +481,13 @@ function getUserFromIdToken(req, idToken) {
 
 The decoded json is return as shown:
 
+```json
+{
+  "alg": "HS256",
+  "typ": "JWT"
+}
+```
+
 ```json
 {
     "organizations": [],
@@ -502,6 +509,18 @@ The decoded json is return as shown:
 }
 ```
 
+To decode the JWT yourself, you can paste the token into the [JWT Website](https://jwt.io/) - The signature used to sign the token is `59de900a973fa2e0` and can be pasted into the website to verify that the encoded identity came from Keyrock
+
+
+```text
+HMACSHA256(
+  base64UrlEncode(header) + "." +
+  base64UrlEncode(payload),
+  59de900a973fa2e0
+)
+```
+
+
 ### Authorization Code - Running the Example
 
 It is possible to invoke the Authorization Code grant flow programmatically, by bringing up the page