Guard against dangerous TTL behavior

Fernet allows you to change `enforce_ttl` and `ttl` on a verifier *after* verification has already happened (it then just ignores them). Due to the subtle way verification works with `Fernet::Verifier`, I've seen three people (including myself) make this mistake and fail to turn properly adjust TTL settings.

I think the right solution is some change in API that makes it explicit that verification has already occurred and these flags are meaningless. I've toyed with having changes trigger a re-verification of the token, but that seems like an awkward functionality. I've also tried to think of a different approach to the API, but don't have any great ideas. I've considered removing the explicit `verify_token` step and do verification implicitly by passing the token in to `#valid?`, but that changes the semantics somewhat (i.e., you would no longer cache the verification step, and would just re-verify every time you wanted to check validity).

In the meantime, this change ensures that if someone does try to use Fernet incorrectly, it fails fast.