preVerifiedTokens

This is my initial sketch for #780

`preVerifiedToken` is a base64Url encoded JWS HS256 with the email address as the payload.

It uses a shared secret set in the config.
We should probably also require the `jwt.sub` actually exists. I'm not sure what code path would cause an undefined email to get here, but the fact that `isValid` returns true if both `jwt.sub` and `email` are `undefined` or `null` smells a bit funny.