Changed getAssertionGUID() algorithm to output SHA256 hashes, not URLs.

@brianloveswords argued that the arbitrary signed-assertion protocol
has no way of actually prescribing a location that can be found
somewhere, which is true. So instead of representing the GUID as a URL,
we will represent it as a hex-encoded SHA256 hash.

If the assertion is hosted, the GUID will be:

  sha256('hosted:' + assertion.verify.url)

Whereas if the assertion is signed, the GUID will be:

  sha256('signed:' + assertion.uid + ':' + origin(assertion.verify.url))