More BrowserID work (don't store assertion in database)

BrowserID assertions are extremely short-lived, so it doesn't make sense
to store them in a persistent replication's document. Instead, store the
email address only. The assertion is registered with the authorizer
before starting replication.