add API endpoint for FxA login

see http://greyface.org/fxa.html for some notes on the intended usage here
it wasn't til just now that I understood how developer pages use the shared-token thing for auth too. Time to rip out the developer-pages-specific FxA login stuff I just did, I guess.