add API endpoint for FxA login

see http://greyface.org/fxa.html for some notes on the intended usage here
I mean other Commonplace projects use this, not just Fireplace.

The developer pages doesn't use the shared token for auth. It still authenticates with Zamboni. It just stores the token into localStorage to maintain synchronicity with Commonplace projects. It only actually uses the token on only one page that's waffle switched off.