             self.header["alg"] = "none"         // if not present, insert 'alg'
         }
         if let alg = algorithms {
+            // TODO: decide if this was smart, as it could introduce a vulnerability for the caller
             self.algorithms = implemented(alg) // only add algoritms that are implemented()
         }
         else {

// MARK: - base64 extensions

extension String {
    func base64SafeUrlDecode() -> NSData { // ! ?
        return self.base64SafeUrlDecode(nil)
    }
    
    func base64SafeUrlDecode(options: NSDataBase64DecodingOptions) -> NSData! {
        var s: String = self;
        
        s = s.stringByReplacingOccurrencesOfString("-", withString: "+") // 62nd char of encoding

        }
    }

    public func loads(jwt: String, key: NSData? = nil, verify: Bool = true, mandatory: [String] = [], error: NSErrorPointer = nil) -> Bool {
        // load a JWT string into this object
        var sig = ""
        var hdr: [String: AnyObject]?
