implement lastAuthAt

This is a work in progress on #307 and #538

I have implemented adding an `authAt` field to the `/account/create` and `/account/login` responses and `fxa-lastAuthAt` to the signed certificate. I added the `fxa-` prefix to match `fxa-generation`.

Without implementing `/session/refresh` I think the intent of forced authentication is functional with the following flow.

The client:
* discovers that it's current certificate's `lastAuthAt` is too old
* calls `/account/login` to get a new session
* calls `/certificate/sign` for a new signed cert with current `lastAuthAt`
* (optionally, but ideally) calls `/session/destroy` on the old session

This leads me to wonder, is that enough? Do we really need `/session/refresh`?