Update demo.scitokens.org to do full Scitokens verification

[djw8605]

Full verification includes the reaching out to retrieve the public key of a token. May need to think about how to protect external website so we don't request from them too much.

[jbasney]

Related to #5. See also davidgtonge/jwt#1 which optionally uses a proxy to fetch the public key.