(WIP) FxA oauth support

https://bugzilla.mozilla.org/show_bug.cgi?id=1041814
Are you just storing an HMAC of the user's email? I suppose that's better than storing the user's email directly and still enables you to do lookups, assuming the canonicalize the email address in the same way before you do the HMAC. It's generally not easy to canonicalize email perfectly, though.