 public class JWT {
     // https://tools.ietf.org/html/draft-ietf-jose-json-web-signature-41#section-4
     // base class; supports alg: none, HS256, HS384, HS512
-    var alg = "none"
-    var header: [String: AnyObject] = ["alg": "none"] {
-        // when header property is set directly, keep track of the "alg" field
+
+    public var header: [String: AnyObject] = ["alg": "none"] {
         didSet {
-            if let alg = header["alg"] as? String {
-                self.alg = alg
-            }
-            else {
-                self.alg = "none"   // if not present, handle (and insert) as alg: none
-                self.header["alg"] = "none"
-            }
-        }
-    }
-    var body: [String: AnyObject] = [:]
-
-    public init() {
-        // defaults above are fine
-    }
-
-    public init(header: [String: AnyObject], body: [String: AnyObject]) {
+            if header["alg"] as? String == nil {
+                self.header["alg"] = "none"     // if not present, insert alg
+            }
+        }
+    }
+    public var body: [String: AnyObject] = [:]
+    var blacklist: [String] = []                // algorithms that are deemed invalid
+
+    public init(blacklist: [String] = []) {
+        self.blacklist = blacklist
+    }
+
+    public init(header: [String: AnyObject], body: [String: AnyObject], blacklist: [String] = []) {
         self.header = header
         self.body = body
-        if let alg = header["alg"] as? String {
-            self.alg = alg
-        }
-        else {
-            self.alg = "none"   // if not present, handle (and insert) as alg: none
-            self.header["alg"] = "none"
+        self.blacklist = blacklist
+        if header["alg"] as? String == nil {
+            self.header["alg"] = "none"         // if not present, insert alg (copy of didSet{} ad init does not trigger it)
         }
     }
 

        return dumps(key_raw, error: error)
    }

    public func signature(msg: NSData, algorithm: String, key: NSData) -> String? {
        switch algorithm {
        case "none":  return ""
        case "HS256": return msg.base64digest(HMACAlgorithm.SHA256, key: key)

        }
    }

    override func verify_signature(msg: NSData, signature: String, algorithm: String, key: NSData? = nil) -> Bool {
        if algorithm == "Ed25519" {
            if key == nil {
                // use the "kid" field as base64 key string as key if no key provided.
