WIP on account events

Not ready for review, seeking feedback.

This is for #59 

* Firstly the name `events` is quite terse but the other names in this repo are terse as well (not judging). @seanmonstar should pick the name.
* `db.removeUser` needs to delete both `codes` and `tokens`. Ideally this would be a transaction or a stored procedure. `lib/mysql.js` doesn't have transactions yet, but could be stolen from fxa-auth-db-server. Or there's sprocs which auth is moving to, but we haven't started here. chicken/egg
* config names. these match some in auth-server but whatevs