Bug 1016423 - Use Hawk for making authenticated HTTP requests and support FxA assertions

See bug https://bugzilla.mozilla.org/show_bug.cgi?id=1016423 please.
We only need to derive the HAWK credentials once per session token, right? Can you cache that info, please? The HKDF function is pretty expensive.