preVerifiedTokens

This is my initial sketch for #780

`preVerifiedToken` is a base64Url encoded JWS HS256 with the email address as the payload.

It uses a shared secret set in the config.
Are we confident that this will automagically do all the right things wrt https, like cert hostname checking?  (Python was insecure-by-default in this regard for years, so I am unusually paranoid about it).

Can we take any additional steps to ensure that we only make proper https requests here?  For example, sanity-check that the trustedJKUs list are all https:// urls in production.