iframe oauth flow.

Follow on for #1437. Review this.

* [ ] - Rebase it all.
* [ ] - Basic RP API. navigator.mozAccounts - what?
* [ ] - Add versioning to RP API<->dialog interaction.
* [ ] - Place RP API file into its own repo.
* [x] - Post verification redirect - how are we going to handle it? Revert the magic.
* [ ] - Is OAuth token automatically submitted in the original tab, or submitted when the user clicks the link?
* [ ] - Confirm how to check whether an origin can use IFRAME - done by content server, oauth server, or based off of redirect_uri in the client? - Based off of redirect_uri in the client.
* [x] - List of origins to be whitelisted - DEFER
* [x] - XFRAME Options - opt-in or automatic? - opt-in via query parameter: `flow=iframe`
* [ ] - Remove GET `/iframe_allowed`




We have decided we should never finish the oauth flow without user interaction. Should we notify the RP?