code: func validateJWTHeader(h string) (ast.Object, error) {
  	header, err := extractJSONObject(h)
  	if err != nil {
  		return nil, fmt.Errorf("bad JWT header: %v", err)
  	}
  
  	// There are two kinds of JWT tokens, a JSON Web Signature (JWS) and
  	// a JSON Web Encryption (JWE). The latter is very involved, and we
  	// won't support it for now.
  	// This code checks which kind of JWT we are dealing with according to
  	// RFC 7516 Section 9: https://tools.ietf.org/html/rfc7516#section-9
  	if header.Get(jwtEncKey) != nil {
  		return nil, errors.New("JWT is a JWE object, which is not supported")
  	}
  
  	return header, nil
  }
docs: // Extract, validate and return the JWT header as an ast.Object.