No magic exists in this setting beyond what is explicitly described in this quesiton. The setting is vaguely European medieval. The question centers around a town large enough to support a nobleman complete with his keep.
The town knows that shapeshifters live in the wild. The populace has yet to determine the creatures' motivation, but the shapeshifters act to seed as much death and destruction upon the town as possible. Efforts to have a civil discussion with the shapeshifters have failed, and nobody knows where they live, except somewhere in the nearby wild (forests, valleys, and rolling hills). Hunting bands haven't located their homes.
They seem equally intelligent--if not more so--than humans, and reports show that they can shift perfectly into a human form within seconds. The exact human form only seems limited to their creativity or knowledge of a specific human's form (if they don't know about a birthmark, they can't reproduce it). They are known to kidnap humans to study them exactly.
The shapeshifters have no other known intrinsic abilities. Any container, wall, or shackles that could stop a human can stop a shapeshifter.
The nobleman is fairly certain, however, that the people of his town drastically outnumber the shapeshifters by the manner of their tactics and time between incidents (no outright attacks, less than a half dozen shapeshifters involved in any one incident), and shapeshifters can be killed, restrained, or otherwise directly dealt with as easily as humans can, so there's hope.
If kept days without food (about a week), the shapeshifter's form will begin to grow sloppy. Likewise corpses will slowly shift back to its gray, nebulous, humanoid form as they begin to rot. These methods can be used as an ultimate means of determining if a given being is human or creature, however neither of these methods are particularly practical.
The town can't simply prove everyone is human and then lock themselves behind a wall, since the local industries of farming, logging, and mining are essential, and trade is conducted with the neighboring communities. The town needs some practical means of establishing a creature as human, or maintaining verification.
Since appearances can be copied, a passphrase can leak or be tortured out, a physical token (like a badge) can be stolen, and (the most recent attempted method) tatoos can be copied (once discovered), it's difficult to solve this problem.
What are possible policies the town can adopt to establish a being's identity, or maintaining verification?