preVerifiedTokens

This is my initial sketch for #780

`preVerifiedToken` is a base64Url encoded JWS HS256 with the email address as the payload.

It uses a shared secret set in the config.
I suspect Marketplace may not be the last migration we need to help with, so it would be a useful exercise to think about how we might manage `preVerifySecrets` for several reliers.

Ideas:
* Index by domain, and lookup based on "iss" in the JWT
* Index by [kid](http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-31#section-4.1.4)
* Use a [jku](http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-31#section-4.1.2). Scalable, but server [verification is fun](http://tools.ietf.org/html/rfc6125#section-6).