preVerifiedTokens

This is my initial sketch for #780

`preVerifiedToken` is a base64Url encoded JWS HS256 with the email address as the payload.

It uses a shared secret set in the config.
I see you're pondering these issues as well. :) https://github.com/mozilla/fxa-auth-server/pull/784#issuecomment-52682696