doc: example implementation

[coolaj86]

Google Sign In (minus the cookie part)

## open browser authorization dialog
GET /api/authn/oidc/accounts.google.com/auth

Magic Link (minus the cookie part)

## new magic link request
POST /authn/challenge
{
  identifier: {
    type: "email",
    value: "xx@xx.xx"
  },
  state: {
    foo: "bar"
  }
}

## Get challenge status
GET /authn/challenge/:id?code=xxx

GET /authn/challenge/:id?receipt=xxx

## cancel a challenge
DELETE /authn/challenge/:id

Cookie-modifying Routes

Note the /authn/session/ prefix for stuff that reads, creates, or modifies a cookie

## Google Sign In redirect for new session
GET /authn/session/oidc/accounts.google.com/code

## Challenge response for new session
POST /authn/session/challenge/:id
{ "code": "xxxx" }

POST /authn/session/challenge/:id
{ "receipt": "xxxx" }

## new login via password
POST /authn/session/credentials
Authorization: Basic xxxxx

# also works with JSON rather than header
{ username: 'xxxx', password: 'xxxx' }

## new id_token via cookie session headers (alias of /authn/refresh)
POST /authn/session/id_token

## Logout
DELETE /authn/session

New Access Token

# new access_token via id_token (alias of /authn/exchange)
POST /authn/access_token
Bearer: Authorization xxxx
{
  account_id: 'xxxx'
}