Do a reverification for FxA PIN reset (bug 1085773)

WIP

See also https://github.com/mozilla/webpay/pull/563
One question is this url always guaranteed to have an exising query string arg?