Crash when handling publisher-generated JWT grant token with invalid account ID

https://sentry.io/organizations/hypothesis/issues/1106040600/

A crash occurs if a publisher with keys for an authority generates a grant token for an invalid user ID (eg. `acct:@authority`) and the client POSTs it to the `/api/token` route.

In one of the reports in the linked Sentry issue, the contents of the JWT token submitted to the endpoint was:

```json
{
"aud": "hypothes.is",
"iss": "d9bb38d6-9c38-11e9-9718-935e4c0dc38c",
"sub": "acct:@h.jonudell.info",
"nbf": 1563383764,
"exp": 1563384364
}
```