Move assert prints to debug log, pull uid from email

* move show assertion to debug so it shows in log
* pull the FxA uid from email if it's returned as a verified assertion
  string (this is somewhat uncommon lately)