Question 1
The header stores the encrypted password used to generate the signature.
The signature only protects the payload section; changes to the header do not affect token validation.
The signature is generated using the encoded header, encoded payload, and a secret key. If the header is modified, the signature verification fails.
The header contains the final signature hash generated after token creation.