a stateless "goldilocks" api

keeps current watch() api, but makes it "stateless" if RP doesn't want
session management. to indicate this, simply don't pass an `onlogout`
handler to watch().

navigator.id.watch({ onlogin: function(assertion) {} });
navigator.id.request(optionsAsNormal);
Merge pull request #3961 from seanmonstar/goldilocks

a stateless "goldilocks" api