@ckarlof, @ryanfeeley I am looking at how to add a "resend" link if the token is expired.

There are two cases to deal with, a user validating in the same browser, and a user validating in a second browser.

In both cases, we need a minimum of an `email` and a `passwordForgotToken`. The fxa-auth-server also accepts `service`, `redirectTo`, and language.

If the user opens the verification link in the same browser, we have all the information. If the user opens the link in a different browser, we have the email address and the `forgotPasswordToken` if `token` on the URL is the same as the `forgotPasswordToken`. We will be missing `service` and `redirectTo`, so the re-sent email will not be customized with those fields. Acceptable?