Fix pyjwt 2.x return type issue and make typing happy

[athornton]

The functional change here is not to call decode() when what we get back from jwt.encode() is already a string rather than a bytes object.

We also update to the released flask-classful 0.16, which will unjam modernization of the rest of the codebase, which requires rewriting a bit of the authorization handling because parse_authorization_headers() will no longer be part of werkzeug (it's a from_header classmethod in werkzeug.Authorization).

I got sick of .DS_Store on my Mac making the repository dirty, so I added it to .gitignore.

Everything else is to get mypy happy with the current codebase--mostly marking all the things that were Optional and defaulted to None as such, marking abstract methods as such, and not then calling those abstract methods. That's going to make modernizing the codebase easier too.

[athornton]

Trying to do too much here. Making a smaller one.