preVerifiedTokens

This is my initial sketch for #780

`preVerifiedToken` is a base64Url encoded JWS HS256 with the email address as the payload.

It uses a shared secret set in the config.
@warner would frown at the node jws API. The `verify` call should be the only way to get the decoded payload and it is only returned if verification passes. We might consider writing a facade around it to make it safer to use.