as you pointed out on IRC, this is a problem: a principal.email of "YOUR-UID@evil-idp.com" would be able to take over YOUR-UID. We should probably add two checks to this function:

* verify that cert.issuer == "accounts.firefox.com" (probably best to parameterize it)
* verify that principal.email has only one "@" and ends with "@accounts.firefox.com"

(doing both checks is probably redundant, but definitely safer)