Add new 'X-DELEGATE' authentication mechanism

This will allow us to not store any password in the browser and provide a passphrase. The passphrase is then sent to the users other online JIDs allowing them to confirm/deny that this request is, in fact, them attempting to authenticate.

@dodo and I are now coding something up in prosody and `node-xmpp-server` as a proof of concept.