iframe oauth flow.

Follow on for #1437. Review this.

* [ ] - Rebase it all.
* [ ] - Basic RP API. navigator.mozAccounts - what?
* [ ] - Add versioning to RP API<->dialog interaction.
* [ ] - Place RP API file into its own repo.
* [x] - Post verification redirect - how are we going to handle it? Revert the magic.
* [ ] - Is OAuth token automatically submitted in the original tab, or submitted when the user clicks the link?
* [ ] - Confirm how to check whether an origin can use IFRAME - done by content server, oauth server, or based off of redirect_uri in the client? - Based off of redirect_uri in the client.
* [x] - List of origins to be whitelisted - DEFER
* [x] - XFRAME Options - opt-in or automatic? - opt-in via query parameter: `flow=iframe`
* [ ] - Remove GET `/iframe_allowed`




What the glob? I'm not sure if this can be tamed to something less eye-gouging like `'i18n/**'` &mdash; although this is outside of the scope of this PR.