preVerifiedTokens

This is my initial sketch for #780

`preVerifiedToken` is a base64Url encoded JWS HS256 with the email address as the payload.

It uses a shared secret set in the config.
For the re-assurance of future readers, it may be worth explicitly noting that the size of this cache is bounded by the number of trusted jkus in the config.