implement login 3.0

https://bugzilla.mozilla.org/show_bug.cgi?id=1090285
This needs to be pre-pended with `/auth`