preVerifiedTokens

This is my initial sketch for #780

`preVerifiedToken` is a base64Url encoded JWS HS256 with the email address as the payload.

It uses a shared secret set in the config.
Will the case where a user tries to re-sign up an already verified email address using a preVerified token return the "account already exists" error?