Account lockout

This is a work-in-progress branch for implementing account lockout, as described in #801.  The first commit is a concrete API spec, for discussion.

Things of note:

* The `resend_code` endpoint has the usual oauth continuation mumbo-jumbo, in keeping with other email-sending endpoints.
* The `verify_code` takes both `uid` and `code`, in the same way that `recovery_email/verify_code` does.  I'm not sure this is a good idea since we will have to make sure the verification page as the `uid` available.  But it's unauthenticated so it can't take the `uid` from its authenticated context like `password/forgot/verify_code`.

@dannycoates @zaach @ncalexan f?
Will the acceptLanguage come from the `lang` option sent to `/account/create`, or is the language determined from the current request's `Accept-Language` header? I'm trying to learn my way around and do not know where [request.app.acceptLanguage](https://github.com/mozilla/fxa-auth-server/pull/840/files#diff-43da5bcdd83eb1d30aa0b5e9e7473834R539) is set.