(WIP) FxA oauth support

https://bugzilla.mozilla.org/show_bug.cgi?id=1041814
>  use the existing state attached to the session 

The existing session state should probably be reset after an attempt was made to compare it (i.e https://github.com/mozilla-services/loop-server/pull/183/files#diff-b460a9062e3a1c561214201459d831f9R65)