try to avoid cache confusion

[bodewig]

closes #399

If you've got two differently configured locations the cache may allow tokens accepted by one location to be used at a different one - even if they would not be valid for the other location's configuration.

This PR does three things:

• separate the caches for JWT verification and token introspection
• use some of the configuration settings of opts as part of the cache key. I later realized this is probably futile so I added explicit configuration via the third step
• adds an option to segregate the cache by assigning a "segment" to a set of related locations

@zandbelt I'm not sure whether we want to leave in the second part at all or just stick with the user-controlled configuration.