title: (Golang) JWT Signature Verification Issue
body: <p>I'm trying to get my head around JWT tokens in Golang. I'm using <a href="http://github.com/dgrijalva/jwt-go" rel="nofollow">github.com/dgrijalva/jwt-go</a>. </p>
  
  <p>What caught me off guard is the fact that I can enter multiple valid signatures.</p>
  
  <p>For example, head over to <a href="http://jwt.io" rel="nofollow">http://jwt.io</a>
  - enter MySuperSecretKey for the secret</p>
  
  <p>This token is valid:</p>
  
  <p>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE0NTc3MzAyODMsInVzZXIiOiJ1c2VyMSJ9.SxshVL42DUH9e7jXUblbB_bTwKxhe4jo70DrvbQMlaU</p>
  
  <p>as well as this one:</p>
  
  <p>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE0NTc3MzAyODMsInVzZXIiOiJ1c2VyMSJ9.SxshVL42DUH9e7jXUblbB_bTwKxhe4jo70DrvbQMlaV</p>
  
  <p>In fact, if I change the last letter to V, W or X, I get a "Signature Verfied" message.</p>
  
  <p>Can anyone tell me what's going on here? </p>