preVerifiedTokens

This is my initial sketch for #780

`preVerifiedToken` is a base64Url encoded JWS HS256 with the email address as the payload.

It uses a shared secret set in the config.
> cert hostname checking?

good call, adding `strictSSL: true` to the request call

> Can we take any additional steps to ensure that we only make proper https requests here?

We could but it'd make dev harder or special cased. Maybe some loud documentation for the config would be good enough?