Pull browserid-local-verify as pinned github dependency

I'm going to merge this change so that future deployments don't accidentally use an out-of-date version of the local verifier code.