iframe oauth flow.

Follow on for #1437. Review this.

* [ ] - Rebase it all.
* [ ] - Basic RP API. navigator.mozAccounts - what?
* [ ] - Add versioning to RP API<->dialog interaction.
* [ ] - Place RP API file into its own repo.
* [x] - Post verification redirect - how are we going to handle it? Revert the magic.
* [ ] - Is OAuth token automatically submitted in the original tab, or submitted when the user clicks the link?
* [ ] - Confirm how to check whether an origin can use IFRAME - done by content server, oauth server, or based off of redirect_uri in the client? - Based off of redirect_uri in the client.
* [x] - List of origins to be whitelisted - DEFER
* [x] - XFRAME Options - opt-in or automatic? - opt-in via query parameter: `flow=iframe`
* [ ] - Remove GET `/iframe_allowed`




Possibly:

```scss
.iframe {
  #main-content {
    box-shadow: 0 0 20px $iframe-box-shadow;
  }

  #close {
    background: image-url('close.png');
    cursor: pointer;
    display: block;
    height: 22px;
    left: 25px;
    position: absolute;
    top: 40px;
    width: 23px;
    z-index: 1000; /* must be one higher than fox-logo */
  }
}
```

Not sure what Sass magic would be needed to nest w/ any of this:
```css
html.iframe,
.iframe body {
  background-color: transparent;
}
```