mozilla/fxa-auth-server — pull request #463 by dannycoates (2014-01-06 19:23:22+00:00)
Title: normalize email on create account using mysql lower()

This is meant to resolve #455

The strategy here is to use mysql's `LOWER()` function on the email when creating the account to leverage its handling of unicode using `CHARACTER SET utf8 COLLATE utf8_unicode_ci` which will yield better results than any javascript normalization.

The normalized email is stored and referenced as the unique identifier for an account during signup and login. The original email bytes sent in `/account/create` are preserved in the `rawEmail` column for use in password verification.

If the client attempts to login with the email in a different case the password verification will fail. If the normalized email matches an existing account the error will contain the `rawEmail` as a hint to the client. The client **may** choose to automatically resubmit the login request with that email. The error looks like:

```json
{
"code": 400,
"errno": 103,
"message": "Incorrect Password",
"email": "correctCase@example.com"
}
```

Remaining questions:

* Should we use `rawEmail` for sending verification emails? This currently uses the normalized email.
* heap.js uses javascript `toLowerCase()` so the behavior is different but should be ok since heap is only used for development.

I'm open to alternatives if we think LOWER isn't the right choice or we don't want to be tied to mysql's implementation but this seems like a reasonable and simple solution to me.

@warner @ncalexan @edmoz f?
@rfk @chilts r?