(WIP) FxA oauth support

https://bugzilla.mozilla.org/show_bug.cgi?id=1041814
Nit: this is a bit confusing to me `if (res.serverError(err)) return;` -> `if (err) return res.serverError(err);`. Will the endpoint respond with a content type JSON error?