Added mechanism for self-authenticated clients

Some providers (like Facebook) offer javascript SDKs that allow for a complete client side authentication. In those cases, the client performs all the authentication steps without the server ever getting touched.

For such cases the `verifyAuth` mechanism is provided. After the client-side authentication completes, and the *Access Token* is available, we can perform a POST request to the server with the *Access Token* in order to:

  1. Inform the server that we are authenticated with a provider
  2. Have the server validate with the provider the authentication
  3. Get back a proper response from the server with our auth logic (our local user data object)

By default the `verifyAuth` mechanism is **turned off**.