Use an asymmetric cipher for loginServer -> connectServer authentication

At the moment we use a shared secret between loginServer and connectServer to allow the latter to verify that the former has verified the user's identity. If the sandbox is breached this shared secret makes it pretty easy to sign IDs (real or fictitious).

If we move loginServer off the GCE instance, we should also switch to signing IDs using an asymmetric cipher instead. This would require someone attempting to use a false or stolen ID to actually modify loginServer to have it accepted, thus leaving behind some evidence of ongoing unauthorised access.