Issue 216 pin flow

I think we're almost ready to sign off, so let's get the code review started.

Caveats:
* UX and Security are still deciding on 6 digit pin versus 7 digit
* I'll rebase before merging

You can compare the tip of this branch against `14260fbecf50424a8bf974a6995b369da7ccfc68` to ignore the 1st attempted production hotfix (Yahoo stateless account linking).