Unfinished no-redirect FxA login flow

do not merge, WIP

makes it as far as the success callback in auth.verifyFxAUser but does somewhere around       `app.session.set('user_hash', data.user_hash)`