(WIP) FxA oauth support

https://bugzilla.mozilla.org/show_bug.cgi?id=1041814
Would a call to `/parameters` always assign new state to the session? thoughts @ckarlof?

In the earlier patch we would use an older state if available i.e 
``` state: req.session.state || crypto.randomBytes(32).toString('hex'),```