a stateless "goldilocks" api

keeps current watch() api, but makes it "stateless" if RP doesn't want
session management. to indicate this, simply don't pass an `onlogout`
handler to watch().

navigator.id.watch({ onlogin: function(assertion) {} });
navigator.id.request(optionsAsNormal);



Two notes:

1. Since there's really only 1 option to pass to watch() for this, I'd think it would be nice to allow passing a function instead of an object with an onlogin parameter.

2. There's some confusion over whether we're keeping the same function names, or introducing configure and prompt. Changing it in this PR is really easy, the only changes would be in include.js.