Clean up Session code, add better documentation.
Handle mustAuth in base.js

* Add the 'mustAuth' flag to the delete_account and settings page & get rid of common code.
Clean up the fxa-client

* Use a mock channel to prevent blowups.
* Ensure the login message is sent to the channel when expected