STILL BROKEN: Needs client_id from device?
normalize assert extract

* Semi-Broken: Having issues validating a FxA assertion, so can't
  determine if the rest of the flow is correct.
Post Demo fixes

* Auth url moved to config
* Simplify auth email extraction from assertion.
* only record locations when valid
* normalize cmd args
* set the lock code as string not number
* added date to the usertodevicemap field
* return devices in date order
** Default specify the current device as the "latest" one.