feat(server): Allow a user to verify their Firefox Account in a second browser.

This is not quite ready. This goes along with https://github.com/mozilla/fxa-content-server/pull/1646
`state === req.session.state` is the request forgery check I was talking about [here](https://github.com/mozilla/fxa-content-server/issues/1623#issuecomment-56418551).