[Security:improvement] Do not accept a "none" signature in JWT if we enforce signature verification

Backport of #1835 (closed) for 1.9 branch