Normalize incoming emails (fix #59)

This is to prevent attackers from varying the case of their email
addresses to work-around rate-limiting.
This matches what the auth server does in https://github.com/mozilla/fxa-auth-server/blob/314d09a7956368466afe503f93d0d925cd5a3b7f/db/httpdb.js#L63