BrowserID login now registers a new user account if necessary

If the assertion is valid but there is no user account with this email
address, a new account will be created. The username will be the same
as the email address, the password will be random, and the set of
channels will be empty (so all this account can do for now is create a
new document.)

As part of this I broadened the character set for usernames so that
email addresses are valid usernames.