Check each component of the relay frame origin separately

The current check against the origin we craft will succeed in the
case of a URL which merely starts with the same text as the
crafted origin.

An example is a URL like "http://example.com@hostile.com" which
would match an origin like "http://example.com".

https://bugzilla.mozilla.org/show_bug.cgi?id=878485
Require a password-level authentication when confirming an email

Since a successful email confirmation leads to an authentication
level of "password", we should ensure that the user is already
authenticated at that level before going ahead with it.

https://bugzilla.mozilla.org/show_bug.cgi?id=908716