preVerifiedTokens

This is my initial sketch for #780

`preVerifiedToken` is a base64Url encoded JWS HS256 with the email address as the payload.

It uses a shared secret set in the config.
It doesn't *need* to be disabled in prod. Its basically a different format of the `/.well-known/browserid` public key. I think it might be useful to keep it in prod if only as an example for other issuers of what a JKU should return.