mozilla/fxa-auth-server — pull request #475 by dannycoates (2014-01-08 22:43:48+00:00)
Title: don't delete keyFetchTokens on use until the account is verified

This should resolve #250

This change only deletes the keyFetchToken if the account is verified. If unverified, the token can be reused until the keys are actually fetched (account is verified) or the account is reset.

@ckarlof @warner is this the desired behavior?