implement handshake prototype

<cade> jbuck: also, for that comment you made on the rate limiting header I'm looking up
<cade> I made an update to webmaker-auth which takes the x-forwarded-for header it gets from the ELB and sets x-forwarded for on the request to the login server
<cade> so, it is the client IP
<cade> also, for non-elb backed instances, it just looks up req.connection.remoteAddress in webmaker-auth
<cade> https://github.com/mozilla/webmaker-auth/pull/15/files#diff-168726dbe96b3ce427e7fedce31bb0bcR129