Valid but unverified JWT querystring values should override all other tokens

[squince]

https://github.com/wballard/starphleet/blob/master/overlay/var/starphleet/nginx/lua/jwt.lua#L145-L173

Currently the code looks to see if there is a verified jwt token in the querystring and if so, uses it - taking priority over any potential cookie jwt and authorization header jwt.

But we need to distinguish between a valid token and a verified token. If someone passes a jwt querystring that has expired, it is unverified, but still valid and should force the user to see the login page regardless of whether they also passed a valid and verified jwt cookie.